Merge with /usr/src/ntfs-2.6.git

645 files changed, 14859 insertions, 9780 deletions

diff --git a/CREDITS b/CREDITS
index c9068febcffc..9bd099d960f3 100644
--- a/CREDITS
+++ b/CREDITS
@@ -339,7 +339,7 @@ W: http://tomas.nocrew.org/
 D: dsp56k device driver
 
 N: Ross Biro
-E: bir7@leland.Stanford.Edu
+E: ross.biro@gmail.com
 D: Original author of the Linux networking code
 
 N: Anton Blanchard
@@ -882,13 +882,12 @@ S: Blacksburg, Virginia 24061
 S: USA
 
 N: Randy Dunlap
-E: rddunlap@osdl.org
+E: rdunlap@xenotime.net
 W: http://www.xenotime.net/linux/linux.html
 W: http://www.linux-usb.org
 D: Linux-USB subsystem, USB core/UHCI/printer/storage drivers
 D: x86 SMP, ACPI, bootflag hacking
-S: 12725 SW Millikan Way, Suite 400
-S: Beaverton, Oregon 97005
+S: (ask for current address)
 S: USA
 
 N: Bob Dunlop
diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index 72dc90f8f4a7..8de8a01a2474 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -12,8 +12,6 @@ Following translations are available on the WWW:
 
 00-INDEX
         - this file.
-BK-usage/
-        - directory with info on BitKeeper.
 BUG-HUNTING
         - brute force method of doing binary search of patches to find bug.
 Changes
diff --git a/Documentation/BK-usage/00-INDEX b/Documentation/BK-usage/00-INDEX
deleted file mode 100644
index 82768784ea52..000000000000
--- a/Documentation/BK-usage/00-INDEX
+++ /dev/null
@@ -1,51 +0,0 @@
-bk-kernel-howto.txt: Description of kernel workflow under BitKeeper
-
-bk-make-sum: Create summary of changesets in one repository and not
-another, typically in preparation to be sent to an upstream maintainer.
-Typical usage:
-        cd my-updated-repo
-        bk-make-sum ~/repo/original-repo
-        mv /tmp/linus.txt ../original-repo.txt
-
-bksend: Create readable text output containing summary of changes, GNU
-patch of the changes, and BK metadata of changes (as needed for proper
-importing into BitKeeper by an upstream maintainer).  This output is
-suitable for emailing BitKeeper changes.  The recipient of this output
-may pipe it directly to 'bk receive'.
-
-bz64wrap: helper script. Uncompressed input is piped to this script,
-which compresses its input, and then outputs the uu-/base64-encoded
-version of the compressed input.
-
-cpcset: Copy changeset between unrelated repositories.
-Attempts to preserve changeset user, user address, description, in
-addition to the changeset (the patch) itself.
-Typical usage:
-        cd my-updated-repo
-        bk changes      # looking for a changeset...
-        cpcset 1.1511 . ../another-repo
-
-csets-to-patches: Produces a delta of two BK repositories, in the form
-of individual files, each containing a single cset as a GNU patch.
-Output is several files, each with the filename "/tmp/rev-$REV.patch"
-Typical usage:
-        cd my-updated-repo
-        bk changes -L ~/repo/original-repo 2>&1 | \
-                perl csets-to-patches
-
-cset-to-linus: Produces a delta of two BK repositories, in the form of
-changeset descriptions, with 'diffstat' output created for each
-individual changset.
-Typical usage:
-        cd my-updated-repo
-        bk changes -L ~/repo/original-repo 2>&1 | \
-                perl cset-to-linus > summary.txt
-
-gcapatch:  Generates patch containing changes in local repository.
-Typical usage:
-        cd my-updated-repo
-        gcapatch > foo.patch
-
-unbz64wrap: Reverse an encoded, compressed data stream created by
-bz64wrap into an uncompressed, typically text/plain output.
-
diff --git a/Documentation/BK-usage/bk-kernel-howto.txt b/Documentation/BK-usage/bk-kernel-howto.txt
deleted file mode 100644
index b7b9075d2910..000000000000
--- a/Documentation/BK-usage/bk-kernel-howto.txt
+++ /dev/null
@@ -1,283 +0,0 @@
-
-                   Doing the BK Thing, Penguin-Style
-
-
-
-
-This set of notes is intended mainly for kernel developers, occasional
-or full-time, but sysadmins and power users may find parts of it useful
-as well.  It assumes at least a basic familiarity with CVS, both at a
-user level (use on the cmd line) and at a higher level (client-server model).
-Due to the author's background, an operation may be described in terms
-of CVS, or in terms of how that operation differs from CVS.
-
-This is -not- intended to be BitKeeper documentation.  Always run
-"bk help <command>" or in X "bk helptool <command>" for reference
-documentation.
-
-
-BitKeeper Concepts
-------------------
-
-In the true nature of the Internet itself, BitKeeper is a distributed
-system.  When applied to revision control, this means doing away with
-client-server, and changing to a parent-child model... essentially
-peer-to-peer.  On the developer's end, this also represents a
-fundamental disruption in the standard workflow of changes, commits,
-and merges.  You will need to take a few minutes to think about
-how to best work under BitKeeper, and re-optimize things a bit.
-In some sense it is a bit radical, because it might described as
-tossing changes out into a maelstrom and having them magically
-land at the right destination... but I'm getting ahead of myself.
-
-Let's start with this progression:
-Each BitKeeper source tree on disk is a repository unto itself.
-Each repository has a parent (except the root/original, of course).
-Each repository contains a set of a changesets ("csets").
-Each cset is one or more changed files, bundled together.
-
-Each tree is a repository, so all changes are checked into the local
-tree.  When a change is checked in, all modified files are grouped
-into a logical unit, the changeset.  Internally, BK links these
-changesets in a tree, representing various converging and diverging
-lines of development.  These changesets are the bread and butter of
-the BK system.
-
-After the concept of changesets, the next thing you need to get used
-to is having multiple copies of source trees lying around.  This -really-
-takes some getting used to, for some people.  Separate source trees
-are the means in BitKeeper by which you delineate parallel lines
-of development, both minor and major.  What would be branches in
-CVS become separate source trees, or "clones" in BitKeeper [heh,
-or Star Wars] terminology.
-
-Clones and changesets are the tools from which most of the power of
-BitKeeper is derived.  As mentioned earlier, each clone has a parent,
-the tree used as the source when the new clone was created.  In a
-CVS-like setup, the parent would be a remote server on the Internet,
-and the child is your local clone of that tree.
-
-Once you have established a common baseline between two source trees --
-a common parent -- then you can merge changesets between those two
-trees with ease.  Merging changes into a tree is called a "pull", and
-is analagous to 'cvs update'.  A pull downloads all the changesets in
-the remote tree you do not have, and merges them.  Sending changes in
-one tree to another tree is called a "push".  Push sends all changes
-in the local tree the remote does not yet have, and merges them.
-
-From these concepts come some initial command examples:
-
-1) bk clone -q http://linux.bkbits.net/linux-2.5 linus-2.5
-Download a 2.5 stock kernel tree, naming it "linus-2.5" in the local dir.
-The "-q" disables listing every single file as it is downloaded.
-
-2) bk clone -ql linus-2.5 alpha-2.5
-Create a separate source tree for the Alpha AXP architecture.
-The "-l" uses hard links instead of copying data, since both trees are
-on the local disk.  You can also replace the above with "bk lclone -q ..."
-
-You only clone a tree -once-.  After cloning the tree lives a long time
-on disk, being updating by pushes and pulls.
-
-3) cd alpha-2.5 ; bk pull http://gkernel.bkbits.net/alpha-2.5
-Download changes in "alpha-2.5" repository which are not present
-in the local repository, and merge them into the source tree.
-
-4) bk -r co -q
-Because every tree is a repository, files must be checked out before
-they will be in their standard places in the source tree.
-
-5)      bk vi fs/inode.c                                # example change...
-        bk citool                                       # checkin, using X tool
-        bk push bk://gkernel@bkbits.net/alpha-2.5       # upload change
-Typical example of a BK sequence that would replace the analagous CVS
-situation,
-        vi fs/inode.c
-        cvs commit
-
-As this is just supposed to be a quick BK intro, for more in-depth
-tutorials, live working demos, and docs, see http://www.bitkeeper.com/
-
-
-
-BK and Kernel Development Workflow
-----------------------------------
-Currently the latest 2.5 tree is available via "bk clone $URL"
-and "bk pull $URL" at http://linux.bkbits.net/linux-2.5
-This should change in a few weeks to a kernel.org URL.
-
-
-A big part of using BitKeeper is organizing the various trees you have
-on your local disk, and organizing the flow of changes among those
-trees, and remote trees.  If one were to graph the relationships between
-a desired BK setup, you are likely to see a few-many-few graph, like
-this:
-
-                    linux-2.5
-                        |
-               merge-to-linus-2.5
-                 /    |      |
-                /     |      |
-        vm-hacks  bugfixes  filesys   personal-hacks
-              \       |      |          /
-               \      |      |         /
-                \     |      |        /
-                 testing-and-validation
-
-Since a "bk push" sends all changes not in the target tree, and
-since a "bk pull" receives all changes not in the source tree, you want
-to make sure you are only pushing specific changes to the desired tree,
-not all changes from "peer parent" trees.  For example, pushing a change
-from the testing-and-validation tree would probably be a bad idea,
-because it will push all changes from vm-hacks, bugfixes, filesys, and
-personal-hacks trees into the target tree.
-
-One would typically work on only one "theme" at a time, either
-vm-hacks or bugfixes or filesys, keeping those changes isolated in
-their own tree during development, and only merge the isolated with
-other changes when going upstream (to Linus or other maintainers) or
-downstream (to your "union" trees, like testing-and-validation above).
-
-It should be noted that some of this separation is not just recommended
-practice, it's actually [for now] -enforced- by BitKeeper.  BitKeeper
-requires that changesets maintain a certain order, which is the reason
-that "bk push" sends all local changesets the remote doesn't have.  This
-separation may look like a lot of wasted disk space at first, but it
-helps when two unrelated changes may "pollute" the same area of code, or
-don't follow the same pace of development, or any other of the standard
-reasons why one creates a development branch.
-
-Small development branches (clones) will appear and disappear:
-
-        -------- A --------- B --------- C --------- D -------
-                  \                                 /
-                   -----short-term devel branch-----
-
-While long-term branches will parallel a tree (or trees), with period
-merge points.  In this first example, we pull from a tree (pulls,
-"\") periodically, such as what occurs when tracking changes in a
-vendor tree, never pushing changes back up the line:
-
-        -------- A --------- B --------- C --------- D -------
-                  \                       \           \
-                   ----long-term devel branch-----------------
-
-And then a more common case in Linux kernel development, a long term
-branch with periodic merges back into the tree (pushes, "/"):
-
-        -------- A --------- B --------- C --------- D -------
-                  \                       \         / \
-                   ----long-term devel branch-----------------
-
-
-
-
-
-Submitting Changes to Linus
----------------------------
-There's a bit of an art, or style, of submitting changes to Linus.
-Since Linus's tree is now (you might say) fully integrated into the
-distributed BitKeeper system, there are several prerequisites to
-properly submitting a BitKeeper change.  All these prereq's are just
-general cleanliness of BK usage, so as people become experts at BK, feel
-free to optimize this process further (assuming Linus agrees, of
-course).
-
-
-
-0) Make sure your tree was originally cloned from the linux-2.5 tree
-created by Linus.  If your tree does not have this as its ancestor, it
-is impossible to reliably exchange changesets.
-
-
-
-1) Pay attention to your commit text.  The commit message that
-accompanies each changeset you submit will live on forever in history,
-and is used by Linus to accurately summarize the changes in each
-pre-patch.  Remember that there is no context, so
-        "fix for new scheduler changes"
-would be too vague, but
-        "fix mips64 arch for new scheduler switch_to(), TIF_xxx semantics"
-would be much better.
-
-You can and should use the command "bk comment -C<rev>" to update the
-commit text, and improve it after the fact.  This is very useful for
-development: poor, quick descriptions during development, which get
-cleaned up using "bk comment" before issuing the "bk push" to submit the
-changes.
-
-
-
-2) Include an Internet-available URL for Linus to pull from, such as
-
-        Pull from:  http://gkernel.bkbits.net/net-drivers-2.5
-
-
-
-3) Include a summary and "diffstat -p1" of each changeset that will be
-downloaded, when Linus issues a "bk pull".  The author auto-generates
-these summaries using "bk changes -L <parent>", to obtain a listing
-of all the pending-to-send changesets, and their commit messages.
-
-It is important to show Linus what he will be downloading when he issues
-a "bk pull", to reduce the time required to sift the changes once they
-are downloaded to Linus's local machine.
-
-IMPORTANT NOTE:  One of the features of BK is that your repository does
-not have to be up to date, in order for Linus to receive your changes.
-It is considered a courtesy to keep your repository fairly recent, to
-lessen any potential merge work Linus may need to do.
-
-
-4) Split up your changes.  Each maintainer<->Linus situation is likely
-to be slightly different here, so take this just as general advice.  The
-author splits up changes according to "themes" when merging with Linus.
-Simultaneous pushes from local development go to special trees which
-exist solely to house changes "queued" for Linus.  Example of the trees:
-
-        net-drivers-2.5 -- on-going net driver maintenance
-        vm-2.5 -- VM-related changes
-        fs-2.5 -- filesystem-related changes
-
-Linus then has much more freedom for pulling changes.  He could (for
-example) issue a "bk pull" on vm-2.5 and fs-2.5 trees, to merge their
-changes, but hold off net-drivers-2.5 because of a change that needs
-more discussion.
-
-Other maintainers may find that a single linus-pull-from tree is
-adequate for passing BK changesets to him.
-
-
-
-Frequently Answered Questions
------------------------------
-1) How do I change the e-mail address shown in the changelog?
-A. When you run "bk citool" or "bk commit", set environment
-   variables BK_USER and BK_HOST to the desired username
-   and host/domain name.
-
-
-2) How do I use tags / get a diff between two kernel versions?
-A. Pass the tags Linus uses to 'bk export'.
-
-ChangeSets are in a forward-progressing order, so it's pretty easy
-to get a snapshot starting and ending at any two points in time.
-Linus puts tags on each release and pre-release, so you could use
-these two examples:
-
-    bk export -tpatch -hdu -rv2.5.4,v2.5.5 | less
-        # creates patch-2.5.5 essentially
-    bk export -tpatch -du -rv2.5.5-pre1,v2.5.5 | less
-        # changes from pre1 to final
-
-A tag is just an alias for a specific changeset... and since changesets
-are ordered, a tag is thus a marker for a specific point in time (or
-specific state of the tree).
-
-
-3) Is there an easy way to generate One Big Patch versus mainline,
-   for my long-lived kernel branch?
-A. Yes.  This requires BK 3.x, though.
-
-        bk export -tpatch -r`bk repogca bk://linux.bkbits.net/linux-2.5`,+
-
diff --git a/Documentation/BK-usage/bk-make-sum b/Documentation/BK-usage/bk-make-sum
deleted file mode 100755
index 58ca46a0fcc6..000000000000
--- a/Documentation/BK-usage/bk-make-sum
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/bin/sh -e
-# DIR=$HOME/BK/axp-2.5
-# cd $DIR
-
-LINUS_REPO=$1
-DIRBASE=`basename $PWD`
-
-{
-cat <<EOT
-Please do a
-
-        bk pull bk://gkernel.bkbits.net/$DIRBASE
-
-This will update the following files:
-
-EOT
-
-bk export -tpatch -hdu -r`bk repogca $LINUS_REPO`,+ | diffstat -p1 2>/dev/null
-
-cat <<EOT
-
-through these ChangeSets:
-
-EOT
-
-bk changes -L -d'$unless(:MERGE:){ChangeSet|:CSETREV:\n}' $LINUS_REPO |
-bk -R prs -h -d'$unless(:MERGE:){<:P:@:HOST:> (:D: :I:)\n$each(:C:){   (:C:)\n}\n}' -
-
-} > /tmp/linus.txt
-
-cat <<EOT
-Mail text in /tmp/linus.txt; please check and send using your favourite
-mailer.
-EOT
diff --git a/Documentation/BK-usage/bksend b/Documentation/BK-usage/bksend
deleted file mode 100755
index 836ca943694f..000000000000
--- a/Documentation/BK-usage/bksend
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/sh
-# A script to format BK changeset output in a manner that is easy to read.
-# Andreas Dilger <adilger@turbolabs.com>  13/02/2002
-#
-# Add diffstat output after Changelog <adilger@turbolabs.com>   21/02/2002
-
-PROG=bksend
-
-usage() {
-        echo "usage: $PROG -r<rev>"
-        echo -e "\twhere <rev> is of the form '1.23', '1.23..', '1.23..1.27',"
-        echo -e "\tor '+' to indicate the most recent revision"
-
-        exit 1
-}
-
-case $1 in
--r) REV=$2; shift ;;
--r*) REV=`echo $1 | sed 's/^-r//'` ;;
-*) echo "$PROG: no revision given, you probably don't want that";;
-esac
-
-[ -z "$REV" ] && usage
-
-echo "You can import this changeset into BK by piping this whole message to:"
-echo "'| bk receive [path to repository]' or apply the patch as usual."
-
-SEP="\n===================================================================\n\n"
-echo -e $SEP
-env PAGER=/bin/cat bk changes -r$REV
-echo
-bk export -tpatch -du -h -r$REV | diffstat
-echo; echo
-bk export -tpatch -du -h -r$REV
-echo -e $SEP
-bk send -wgzip_uu -r$REV -
diff --git a/Documentation/BK-usage/bz64wrap b/Documentation/BK-usage/bz64wrap
deleted file mode 100755
index be780876849f..000000000000
--- a/Documentation/BK-usage/bz64wrap
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/bin/sh
-
-# bz64wrap - the sending side of a bzip2 | base64 stream
-# Andreas Dilger <adilger@clusterfs.com>   Jan 2002
-
-
-PATH=$PATH:/usr/bin:/usr/local/bin:/usr/freeware/bin
-
-# A program to generate base64 encoding on stdout
-BASE64_ENCODE="uuencode -m /dev/stdout"
-BASE64_BEGIN=
-BASE64_END=
-
-BZIP=NO
-BASE64=NO
-
-# Test if we have the bzip program installed
-bzip2 -c /dev/null > /dev/null 2>&1 && BZIP=YES
-
-# Test if uuencode can handle the -m (MIME) encoding option
-$BASE64_ENCODE < /dev/null > /dev/null 2>&1 && BASE64=YES
-
-if [ $BASE64 = NO ]; then
-        BASE64_ENCODE=mimencode
-        BASE64_BEGIN="begin-base64 644 -"
-        BASE64_END="===="
-
-        $BASE64_ENCODE < /dev/null > /dev/null 2>&1 && BASE64=YES
-fi
-
-if [ $BZIP = NO -o $BASE64 = NO ]; then
-        echo "$0: can't use bz64 encoding: bzip2=$BZIP, $BASE64_ENCODE=$BASE64"
-        exit 1
-fi
-
-# Sadly, mimencode does not appear to have good "begin" and "end" markers
-# like uuencode does, and it is picky about getting the right start/end of
-# the base64 stream, so we handle this internally.
-echo "$BASE64_BEGIN"
-bzip2 -9 | $BASE64_ENCODE
-echo "$BASE64_END"
diff --git a/Documentation/BK-usage/cpcset b/Documentation/BK-usage/cpcset
deleted file mode 100755
index b8faca97dab9..000000000000
--- a/Documentation/BK-usage/cpcset
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/sh
-#
-# Purpose: Copy changeset patch and description from one
-#          repository to another, unrelated one.
-#
-# usage:  cpcset [revision] [from-repository] [to-repository]
-#
-
-REV=$1
-FROM=$2
-TO=$3
-TMPF=/tmp/cpcset.$$
-
-rm -f $TMPF*
-
-CWD_SAVE=`pwd`
-cd $FROM
-bk changes -r$REV                       |       \
-        grep -v '^ChangeSet'            |       \
-        sed -e 's/^  //g' > $TMPF.log
-
-USERHOST=`bk changes -r$REV | grep '^ChangeSet' | awk '{print $4}'`
-export BK_USER=`echo $USERHOST | awk '-F@' '{print $1}'`
-export BK_HOST=`echo $USERHOST | awk '-F@' '{print $2}'`
-
-bk export -tpatch -hdu -r$REV > $TMPF.patch && \
-cd $CWD_SAVE && \
-cd $TO && \
-bk import -tpatch -CFR -y"`cat $TMPF.log`" $TMPF.patch . && \
-bk commit -y"`cat $TMPF.log`"
-
-rm -f $TMPF*
-
-echo changeset $REV copied.
-echo ""
-
diff --git a/Documentation/BK-usage/cset-to-linus b/Documentation/BK-usage/cset-to-linus
deleted file mode 100755
index d28a96f8c618..000000000000
--- a/Documentation/BK-usage/cset-to-linus
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/perl -w
-
-use strict;
-
-my ($lhs, $rev, $tmp, $rhs, $s);
-my @cset_text = ();
-my @pipe_text = ();
-my $have_cset = 0;
-
-while (<>) {
-        next if /^---/;
-
-        if (($lhs, $tmp, $rhs) = (/^(ChangeSet\@)([^,]+)(, .*)$/)) {
-                &cset_rev if ($have_cset);
-
-                $rev = $tmp;
-                $have_cset = 1;
-
-                push(@cset_text, $_);
-        }
-
-        elsif ($have_cset) {
-                push(@cset_text, $_);
-        }
-}
-&cset_rev if ($have_cset);
-exit(0);
-
-
-sub cset_rev {
-        my $empty_cset = 0;
-
-        open PIPE, "bk export -tpatch -hdu -r $rev | diffstat -p1 2>/dev/null |" or die;
-        while ($s = <PIPE>) {
-                $empty_cset = 1 if ($s =~ /0 files changed/);
-                push(@pipe_text, $s);
-        }
-        close(PIPE);
-
-        if (! $empty_cset) {
-                print @cset_text;
-                print @pipe_text;
-                print "\n\n";
-        }
-
-        @pipe_text = ();
-        @cset_text = ();
-}
-
diff --git a/Documentation/BK-usage/csets-to-patches b/Documentation/BK-usage/csets-to-patches
deleted file mode 100755
index e2b81c35883f..000000000000
--- a/Documentation/BK-usage/csets-to-patches
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/perl -w
-
-use strict;
-
-my ($lhs, $rev, $tmp, $rhs, $s);
-my @cset_text = ();
-my @pipe_text = ();
-my $have_cset = 0;
-
-while (<>) {
-        next if /^---/;
-
-        if (($lhs, $tmp, $rhs) = (/^(ChangeSet\@)([^,]+)(, .*)$/)) {
-                &cset_rev if ($have_cset);
-
-                $rev = $tmp;
-                $have_cset = 1;
-
-                push(@cset_text, $_);
-        }
-
-        elsif ($have_cset) {
-                push(@cset_text, $_);
-        }
-}
-&cset_rev if ($have_cset);
-exit(0);
-
-
-sub cset_rev {
-        my $empty_cset = 0;
-
-        system("bk export -tpatch -du -r $rev > /tmp/rev-$rev.patch");
-
-        if (! $empty_cset) {
-                print @cset_text;
-                print @pipe_text;
-                print "\n\n";
-        }
-
-        @pipe_text = ();
-        @cset_text = ();
-}
-
diff --git a/Documentation/BK-usage/gcapatch b/Documentation/BK-usage/gcapatch
deleted file mode 100755
index aaeb17dc7c7f..000000000000
--- a/Documentation/BK-usage/gcapatch
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-#
-# Purpose: Generate GNU diff of local changes versus canonical top-of-tree
-#
-# Usage: gcapatch > foo.patch
-#
-
-bk export -tpatch -hdu -r`bk repogca bk://linux.bkbits.net/linux-2.5`,+
diff --git a/Documentation/BK-usage/unbz64wrap b/Documentation/BK-usage/unbz64wrap
deleted file mode 100755
index 4fc3e73e9a81..000000000000
--- a/Documentation/BK-usage/unbz64wrap
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/sh
-
-# unbz64wrap - the receiving side of a bzip2 | base64 stream
-# Andreas Dilger <adilger@clusterfs.com>   Jan 2002
-
-# Sadly, mimencode does not appear to have good "begin" and "end" markers
-# like uuencode does, and it is picky about getting the right start/end of
-# the base64 stream, so we handle this explicitly here.
-
-PATH=$PATH:/usr/bin:/usr/local/bin:/usr/freeware/bin
-
-if mimencode -u < /dev/null > /dev/null 2>&1 ; then
-        SHOW=
-        while read LINE; do
-                case $LINE in
-                begin-base64*) SHOW=YES ;;
-                ====) SHOW= ;;
-                *) [ "$SHOW" ] && echo "$LINE" ;;
-                esac
-        done | mimencode -u | bunzip2
-        exit $?
-else
-        cat - | uudecode -o /dev/stdout | bunzip2
-        exit $?
-fi
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index 1ad26d2c20ae..2f8f24eaefd9 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -252,8 +252,7 @@ in a tasks processor placement.
 There is an exception to the above.  If hotplug funtionality is used
 to remove all the CPUs that are currently assigned to a cpuset,
 then the kernel will automatically update the cpus_allowed of all
-tasks attached to CPUs in that cpuset with the online CPUs of the
-nearest parent cpuset that still has some CPUs online.  When memory
+tasks attached to CPUs in that cpuset to allow all CPUs.  When memory
 hotplug functionality for removing Memory Nodes is available, a
 similar exception is expected to apply there as well.  In general,
 the kernel prefers to violate cpuset placement, over starving a task
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
index 7c2496426ab9..9a33bb94f74f 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -27,6 +27,7 @@
 *.so
 *.tex
 *.ver
+*.xml
 *_MODULES
 *_vga16.c
 *cscope*
@@ -110,6 +111,7 @@ mkdep
 mktables
 modpost
 modversions.h*
+offsets.h
 oui.c*
 parse.c*
 parse.h*
@@ -134,4 +136,5 @@ vmlinux-*
 vmlinux.lds
 vsyscall.lds
 wanxlfw.inc
+uImage
 zImage
diff --git a/Documentation/dvb/README.flexcop b/Documentation/dvb/README.flexcop
new file mode 100644
index 000000000000..a50c70f9ca72
--- /dev/null
+++ b/Documentation/dvb/README.flexcop
@@ -0,0 +1,205 @@
+This README escorted the skystar2-driver rewriting procedure. It describes the
+state of the new flexcop-driver set and some internals are written down here
+too.
+
+This document hopefully describes things about the flexcop and its
+device-offsprings. Goal was to write an easy-to-write and easy-to-read set of
+drivers based on the skystar2.c and other information.
+
+Remark: flexcop-pci.c was a copy of skystar2.c, but every line has been
+touched and rewritten.
+
+History & News
+==============
+  2005-04-01 - correct USB ISOC transfers (thanks to Vadim Catana)
+
+
+
+
+General coding processing
+=========================
+
+We should proceed as follows (as long as no one complains):
+
+0) Think before start writing code!
+
+1) rewriting the skystar2.c with the help of the flexcop register descriptions
+and splitting up the files to a pci-bus-part and a flexcop-part.
+The new driver will be called b2c2-flexcop-pci.ko/b2c2-flexcop-usb.ko for the
+device-specific part and b2c2-flexcop.ko for the common flexcop-functions.
+
+2) Search for errors in the leftover of flexcop-pci.c (compare with pluto2.c
+and other pci drivers)
+
+3) make some beautification (see 'Improvements when rewriting (refactoring) is
+done')
+
+4) Testing the new driver and maybe substitute the skystar2.c with it, to reach
+a wider tester audience.
+
+5) creating an usb-bus-part using the already written flexcop code for the pci
+card.
+
+Idea: create a kernel-object for the flexcop and export all important
+functions. This option saves kernel-memory, but maybe a lot of functions have
+to be exported to kernel namespace.
+
+
+Current situation
+=================
+
+0) Done :)
+1) Done (some minor issues left)
+2) Done
+3) Not ready yet, more information is necessary
+4) next to be done (see the table below)
+5) USB driver is working (yes, there are some minor issues)
+
+What seems to be ready?
+-----------------------
+
+1) Rewriting
+1a) i2c is cut off from the flexcop-pci.c and seems to work
+1b) moved tuner and demod stuff from flexcop-pci.c to flexcop-tuner-fe.c
+1c) moved lnb and diseqc stuff from flexcop-pci.c to flexcop-tuner-fe.c
+1e) eeprom (reading MAC address)
+1d) sram (no dynamic sll size detection (commented out) (using default as JJ told me))
+1f) misc. register accesses for reading parameters (e.g. resetting, revision)
+1g) pid/mac filter (flexcop-hw-filter.c)
+1i) dvb-stuff initialization in flexcop.c (done)
+1h) dma stuff (now just using the size-irq, instead of all-together, to be done)
+1j) remove flexcop initialization from flexcop-pci.c completely (done)
+1l) use a well working dma IRQ method (done, see 'Known bugs and problems and TODO')
+1k) cleanup flexcop-files (remove unused EXPORT_SYMBOLs, make static from
+non-static where possible, moved code to proper places)
+
+2) Search for errors in the leftover of flexcop-pci.c (partially done)
+5a) add MAC address reading
+5c) feeding of ISOC data to the software demux (format of the isochronous data
+and speed optimization, no real error) (thanks to Vadim Catana)
+
+What to do in the near future?
+--------------------------------------
+(no special order here)
+
+5) USB driver
+5b) optimize isoc-transfer (submitting/killing isoc URBs when transfer is starting)
+
+Testing changes
+---------------
+
+O             = item is working
+P             = item is partially working
+X             = item is not working
+N             = item does not apply here
+<empty field> = item need to be examined
+
+       | PCI                               | USB
+item   | mt352 | nxt2002 | stv0299 | mt312 | mt352 | nxt2002 | stv0299 | mt312
+-------+-------+---------+---------+-------+-------+---------+---------+-------
+1a)    | O     |         |         |       | N     | N       | N       | N
+1b)    | O     |         |         |       |       |         | O       |
+1c)    | N     | N       |         |       | N     | N       | O       |
+1d)    |                 O                 |                 O
+1e)    |                 O                 |                 O
+1f)    |                                   P
+1g)    |                                   O
+1h)    |                 P                 |
+1i)    |                 O                 |                 N
+1j)    |                 O                 |                 N
+1l)    |                 O                 |                 N
+2)     |                 O                 |                 N
+5a)    |                 N                 |                 O
+5b)*   |                 N                 |
+5c)    |                 N                 |                 O
+
+* - not done yet
+
+Known bugs and problems and TODO
+--------------------------------
+
+1g/h/l) when pid filtering is enabled on the pci card
+
+DMA usage currently:
+  The DMA is splitted in 2 equal-sized subbuffers. The Flexcop writes to first
+  address and triggers an IRQ when it's full and starts writing to the second
+  address. When the second address is full, the IRQ is triggered again, and
+  the flexcop writes to first address again, and so on.
+  The buffersize of each address is currently 640*188 bytes.
+
+  Problem is, when using hw-pid-filtering and doing some low-bandwidth
+  operation (like scanning) the buffers won't be filled enough to trigger
+  the IRQ. That's why:
+
+  When PID filtering is activated, the timer IRQ is used. Every 1.97 ms the IRQ
+  is triggered.  Is the current write address of DMA1 different to the one
+  during the last IRQ, then the data is passed to the demuxer.
+
+  There is an additional DMA-IRQ-method: packet count IRQ. This isn't
+  implemented correctly yet.
+
+  The solution is to disable HW PID filtering, but I don't know how the DVB
+  API software demux behaves on slow systems with 45MBit/s TS.
+
+Solved bugs :)
+--------------
+1g) pid-filtering (somehow pid index 4 and 5 (EMM_PID and ECM_PID) aren't
+working)
+SOLUTION: also index 0 was affected, because net_translation is done for
+these indexes by default
+
+5b) isochronous transfer does only work in the first attempt (for the Sky2PC
+USB, Air2PC is working) SOLUTION: the flexcop was going asleep and never really
+woke up again (don't know if this need fixes, see
+flexcop-fe-tuner.c:flexcop_sleep)
+
+NEWS: when the driver is loaded and unloaded and loaded again (w/o doing
+anything in the while the driver is loaded the first time), no transfers take
+place anymore.
+
+Improvements when rewriting (refactoring) is done
+=================================================
+
+- split sleeping of the flexcop (misc_204.ACPI3_sig = 1;) from lnb_control
+  (enable sleeping for other demods than dvb-s)
+- add support for CableStar (stv0297 Microtune 203x/ALPS) (almost done, incompatibilities with the Nexus-CA)
+
+Debugging
+---------
+- add verbose debugging to skystar2.c (dump the reg_dw_data) and compare it
+  with this flexcop, this is important, because i2c is now using the
+  flexcop_ibi_value union from flexcop-reg.h (do you have a better idea for
+  that, please tell us so).
+
+Everything which is identical in the following table, can be put into a common
+flexcop-module.
+
+                  PCI                  USB
+-------------------------------------------------------------------------------
+Different:
+Register access:  accessing IO memory  USB control message
+I2C bus:          I2C bus of the FC    USB control message
+Data transfer:    DMA                  isochronous transfer
+EEPROM transfer:  through i2c bus      not clear yet
+
+Identical:
+Streaming:                 accessing registers
+PID Filtering:             accessing registers
+Sram destinations:         accessing registers
+Tuner/Demod:                     I2C bus
+DVB-stuff:            can be written for common use
+
+Acknowledgements (just for the rewriting part)
+================
+
+Bjarne Steinsbo thought a lot in the first place of the pci part for this code
+sharing idea.
+
+Andreas Oberritter for providing a recent PCI initialization template
+(pluto2.c).
+
+Boleslaw Ciesielski for pointing out a problem with firmware loader.
+
+Vadim Catana for correcting the USB transfer.
+
+comments, critics and ideas to linux-dvb@linuxtv.org.
diff --git a/Documentation/dvb/bt8xx.txt b/Documentation/dvb/bt8xx.txt
index e3cacf4f2345..d64430bf4bb6 100644
--- a/Documentation/dvb/bt8xx.txt
+++ b/Documentation/dvb/bt8xx.txt
@@ -17,74 +17,53 @@ Because of this, you need to enable
 "Device drivers" => "Multimedia devices"
   => "Video For Linux" => "BT848 Video For Linux"
 
+Furthermore you need to enable
+"Device drivers" => "Multimedia devices" => "Digital Video Broadcasting Devices"
+  => "DVB for Linux" "DVB Core Support" "Nebula/Pinnacle PCTV/TwinHan PCI Cards"
+
 2) Loading Modules
 ==================
 
 In general you need to load the bttv driver, which will handle the gpio and
-i2c communication for us. Next you need the common dvb-bt8xx device driver
-and one frontend driver.
-
-The bttv driver will HANG YOUR SYSTEM IF YOU DO NOT SPECIFY THE CORRECT 
-CARD ID!
-
-(If you don't get your card running and you suspect that the card id you're
-using is wrong, have a look at "bttv-cards.c" for a list of possible card
-ids.)
-
-Pay attention to failures when you load the frontend drivers
-(e.g. dmesg, /var/log/messages).
+i2c communication for us, plus the common dvb-bt8xx device driver.
+The frontends for Nebula (nxt6000), Pinnacle PCTV (cx24110) and
+TwinHan (dst) are loaded automatically by the dvb-bt8xx device driver.
 
 3a) Nebula / Pinnacle PCTV
 --------------------------
 
-   $ modprobe bttv i2c_hw=1 card=0x68
-   $ modprobe dvb-bt8xx
-   
-For Nebula cards use the "nxt6000" frontend driver:
-   $ modprobe nxt6000
+   $ modprobe bttv (normally bttv is being loaded automatically by kmod)
+   $ modprobe dvb-bt8xx (or just place dvb-bt8xx in /etc/modules for automatic loading)
 
-For Pinnacle PCTV cards use the "cx24110" frontend driver:
-   $ modprobe cx24110
 
-3b) TwinHan
------------
+3b) TwinHan and Clones
+--------------------------
 
    $ modprobe bttv i2c_hw=1 card=0x71
    $ modprobe dvb-bt8xx
    $ modprobe dst
 
-The value 0x71 will override the PCI type detection for dvb-bt8xx, which 
-is necessary for TwinHan cards.#
+The value 0x71 will override the PCI type detection for dvb-bt8xx,
+which  is necessary for TwinHan cards.
 
-If you're having an older card (blue color circuit) and card=0x71 locks your
-machine, try using 0x68, too. If that does not work, ask on the DVB mailing list.
+If you're having an older card (blue color circuit) and card=0x71 locks
+your machine, try using 0x68, too. If that does not work, ask on the
+mailing list.
 
-The DST module takes a couple of useful parameters, in case the
-dst drivers fails to detect your type of card correctly.
+The DST module takes a couple of useful parameters.
 
-dst_type takes values 0 (satellite), 1 (terrestial TV), 2 (cable).
+verbose takes values 0 to 5. These values control the verbosity level.
 
-dst_type_flags takes bit combined values:
-1 = new tuner type packets. You can use this if your card is detected
-    and you have debug and you continually see the tuner packets not
-    working (make sure not a basic problem like dish alignment etc.)
+debug takes values 0 and 1. You can either disable or enable debugging.
 
-2 = TS 204. If your card tunes OK, but the picture is terrible, seemingly
-    breaking up in one half continually, and crc fails a lot, then
-    this is worth a try (or trying to turn off)
+dst_addons takes values 0 and 0x20. A value of 0 means it is a FTA card.
+0x20 means it has a Conditional Access slot.
 
-4 = has symdiv. Some cards, mostly without new tuner packets, require
-    a symbol division algorithm. Doesn't apply to terrestial TV.
-
-You can also specify a value to have the autodetected values turned off
-(e.g. 0). The autodected values are determined bythe cards 'response
+The autodected values are determined bythe cards 'response
 string' which you can see in your logs e.g.
 
-dst_check_ci: recognize DST-MOT
-
-or 
+dst_get_device_id: Recognise [DSTMCI]
 
-dst_check_ci: unable to recognize DSTXCI or STXCI
 
 --
-Authors: Richard Walker, Jamie Honan, Michael Hunold
+Authors: Richard Walker, Jamie Honan, Michael Hunold, Manu Abraham
diff --git a/Documentation/dvb/ci.txt b/Documentation/dvb/ci.txt
new file mode 100644
index 000000000000..62e0701b542a
--- /dev/null
+++ b/Documentation/dvb/ci.txt
@@ -0,0 +1,219 @@
+* For the user
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+NOTE: This document describes the usage of the high level CI API as
+in accordance to the Linux DVB API. This is a not a documentation for the,
+existing low level CI API.
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To utilize the High Level CI capabilities,
+
+(1*) This point is valid only for the Twinhan/clones
+  For the Twinhan/Twinhan clones, the dst_ca module handles the CI
+  hardware handling.This module is loaded automatically if a CI
+  (Common Interface, that holds the CAM (Conditional Access Module)
+  is detected.
+
+(2) one requires a userspace application, ca_zap. This small userland
+  application is in charge of sending the descrambling related information
+  to the CAM.
+
+This application requires the following to function properly as of now.
+
+        (a) Tune to a valid channel, with szap.
+          eg: $ szap -c channels.conf -r "TMC" -x
+
+        (b) a channels.conf containing a valid PMT PID
+
+          eg: TMC:11996:h:0:27500:278:512:650:321
+
+          here 278 is a valid PMT PID. the rest of the values are the
+          same ones that szap uses.
+
+        (c) after running a szap, you have to run ca_zap, for the
+          descrambler to function,
+
+          eg: $ ca_zap patched_channels.conf "TMC"
+
+          The patched means a patch to apply to scan, such that scan can
+          generate a channels.conf_with pmt, which has this PMT PID info
+          (NOTE: szap cannot use this channels.conf with the PMT_PID)
+
+
+        (d) Hopeflly Enjoy your favourite subscribed channel as you do with
+          a FTA card.
+
+(3) Currently ca_zap, and dst_test, both are meant for demonstration
+  purposes only, they can become full fledged applications if necessary.
+
+
+* Cards that fall in this category
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+At present the cards that fall in this category are the Twinhan and it's
+clones, these cards are available as VVMER, Tomato, Hercules, Orange and
+so on.
+
+* CI modules that are supported
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+The CI module support is largely dependant upon the firmware on the cards
+Some cards do support almost all of the available CI modules. There is
+nothing much that can be done in order to make additional CI modules
+working with these cards.
+
+Modules that have been tested by this driver at present are
+
+(1) Irdeto 1 and 2 from SCM
+(2) Viaccess from SCM
+(3) Dragoncam
+
+* The High level CI API
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* For the programmer
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+With the High Level CI approach any new card with almost any random
+architecture can be implemented with this style, the definitions
+insidethe switch statement can be easily adapted for any card, thereby
+eliminating the need for any additional ioctls.
+
+The disadvantage is that the driver/hardware has to manage the rest. For
+the application programmer it would be as simple as sending/receiving an
+array to/from the CI ioctls as defined in the Linux DVB API. No changes
+have been made in the API to accomodate this feature.
+
+
+* Why the need for another CI interface ?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This is one of the most commonly asked question. Well a nice question.
+Strictly speaking this is not a new interface.
+
+The CI interface is defined in the DVB API in ca.h as
+
+typedef struct ca_slot_info {
+        int num;               /* slot number */
+
+        int type;              /* CA interface this slot supports */
+#define CA_CI            1     /* CI high level interface */
+#define CA_CI_LINK       2     /* CI link layer level interface */
+#define CA_CI_PHYS       4     /* CI physical layer level interface */
+#define CA_DESCR         8     /* built-in descrambler */
+#define CA_SC          128     /* simple smart card interface */
+
+        unsigned int flags;
+#define CA_CI_MODULE_PRESENT 1 /* module (or card) inserted */
+#define CA_CI_MODULE_READY   2
+} ca_slot_info_t;
+
+
+
+This CI interface follows the CI high level interface, which is not
+implemented by most applications. Hence this area is revisited.
+
+This CI interface is quite different in the case that it tries to
+accomodate all other CI based devices, that fall into the other categories
+
+This means that this CI interface handles the EN50221 style tags in the
+Application layer only and no session management is taken care of by the
+application. The driver/hardware will take care of all that.
+
+This interface is purely an EN50221 interface exchanging APDU's. This
+means that no session management, link layer or a transport layer do
+exist in this case in the application to driver communication. It is
+as simple as that. The driver/hardware has to take care of that.
+
+
+With this High Level CI interface, the interface can be defined with the
+regular ioctls.
+
+All these ioctls are also valid for the High level CI interface
+
+#define CA_RESET          _IO('o', 128)
+#define CA_GET_CAP        _IOR('o', 129, ca_caps_t)
+#define CA_GET_SLOT_INFO  _IOR('o', 130, ca_slot_info_t)
+#define CA_GET_DESCR_INFO _IOR('o', 131, ca_descr_info_t)
+#define CA_GET_MSG        _IOR('o', 132, ca_msg_t)
+#define CA_SEND_MSG       _IOW('o', 133, ca_msg_t)
+#define CA_SET_DESCR      _IOW('o', 134, ca_descr_t)
+#define CA_SET_PID        _IOW('o', 135, ca_pid_t)
+
+
+On querying the device, the device yields information thus
+
+CA_GET_SLOT_INFO
+----------------------------
+Command = [info]
+APP: Number=[1]
+APP: Type=[1]
+APP: flags=[1]
+APP: CI High level interface
+APP: CA/CI Module Present
+
+CA_GET_CAP
+----------------------------
+Command = [caps]
+APP: Slots=[1]
+APP: Type=[1]
+APP: Descrambler keys=[16]
+APP: Type=[1]
+
+CA_SEND_MSG
+----------------------------
+Descriptors(Program Level)=[ 09 06 06 04 05 50 ff f1]
+Found CA descriptor @ program level
+
+(20) ES type=[2] ES pid=[201]  ES length =[0 (0x0)]
+(25) ES type=[4] ES pid=[301]  ES length =[0 (0x0)]
+ca_message length is 25 (0x19) bytes
+EN50221 CA MSG=[ 9f 80 32 19 03 01 2d d1 f0 08 01 09 06 06 04 05 50 ff f1 02 e0 c9 00 00 04 e1 2d 00 00]
+
+
+Not all ioctl's are implemented in the driver from the API, the other
+features of the hardware that cannot be implemented by the API are achieved
+using the CA_GET_MSG and CA_SEND_MSG ioctls. An EN50221 style wrapper is
+used to exchange the data to maintain compatibility with other hardware.
+
+
+/* a message to/from a CI-CAM */
+typedef struct ca_msg {
+        unsigned int index;
+        unsigned int type;
+        unsigned int length;
+        unsigned char msg[256];
+} ca_msg_t;
+
+
+The flow of data can be described thus,
+
+
+
+
+
+        App (User)
+        -----
+        parse
+          |
+          |
+          v
+        en50221 APDU (package)
+   --------------------------------------
+   |      |                             | High Level CI driver
+   |      |                             |
+   |      v                             |
+   |    en50221 APDU (unpackage)        |
+   |      |                             |
+   |      |                             |
+   |      v                             |
+   |    sanity checks                   |
+   |      |                             |
+   |      |                             |
+   |      v                             |
+   |    do (H/W dep)                    |
+   --------------------------------------
+          |    Hardware
+          |
+          v
+
+
+
+
+The High Level CI interface uses the EN50221 DVB standard, following a
+standard ensures futureproofness.
diff --git a/Documentation/dvb/get_dvb_firmware b/Documentation/dvb/get_dvb_firmware
index 3ffdcb394299..a750f0101d9d 100644
--- a/Documentation/dvb/get_dvb_firmware
+++ b/Documentation/dvb/get_dvb_firmware
@@ -107,7 +107,7 @@ sub tda10045 {
 sub tda10046 {
     my $sourcefile = "tt_budget_217g.zip";
     my $url = "http://www.technotrend.de/new/217g/$sourcefile";
-    my $hash = "a25b579e37109af60f4a36c37893957c";
+    my $hash = "6a7e1e2f2644b162ff0502367553c72d";
     my $outfile = "dvb-fe-tda10046.fw";
     my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
 
@@ -115,7 +115,7 @@ sub tda10046 {
 
     wgetfile($sourcefile, $url);
     unzip($sourcefile, $tmpdir);
-    extract("$tmpdir/software/OEM/PCI/App/ttlcdacc.dll", 0x3f731, 24479, "$tmpdir/fwtmp");
+    extract("$tmpdir/software/OEM/PCI/App/ttlcdacc.dll", 0x3f731, 24478, "$tmpdir/fwtmp");
     verify("$tmpdir/fwtmp", $hash);
     copy("$tmpdir/fwtmp", $outfile);
 
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index d3c52dd24a2a..b9eb209318ab 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -63,3 +63,23 @@ Why:	Outside of Linux, the only implementations of anything even
         people, who might be using implementations that I am not aware
         of, to adjust to this upcoming change.
 Who:    Paul E. McKenney <paulmck@us.ibm.com>
+
+---------------------------
+
+What:   IEEE1394 Audio and Music Data Transmission Protocol driver,
+        Connection Management Procedures driver
+When:   November 2005
+Files:  drivers/ieee1394/{amdtp,cmp}*
+Why:    These are incomplete, have never worked, and are better implemented
+        in userland via raw1394 (see http://freebob.sourceforge.net/ for
+        example.)
+Who:    Jody McIntyre <scjody@steamballoon.com>
+
+---------------------------
+
+What:   raw1394: requests of type RAW1394_REQ_ISO_SEND, RAW1394_REQ_ISO_LISTEN
+When:   November 2005
+Why:    Deprecated in favour of the new ioctl-based rawiso interface, which is
+        more efficient.  You should really be using libraw1394 for raw1394
+        access anyway.
+Who:    Jody McIntyre <scjody@steamballoon.com>
diff --git a/Documentation/filesystems/sysfs-pci.txt b/Documentation/filesystems/sysfs-pci.txt
index e97d024eae77..988a62fae11f 100644
--- a/Documentation/filesystems/sysfs-pci.txt
+++ b/Documentation/filesystems/sysfs-pci.txt
@@ -7,7 +7,6 @@ that support it.  For example, a given bus might look like this:
      |-- 0000:17:00.0
      |   |-- class
      |   |-- config
-     |   |-- detach_state
      |   |-- device
      |   |-- irq
      |   |-- local_cpus
@@ -19,7 +18,7 @@ that support it.  For example, a given bus might look like this:
      |   |-- subsystem_device
      |   |-- subsystem_vendor
      |   `-- vendor
-     `-- detach_state
+     `-- ...
 
 The topmost element describes the PCI domain and bus number.  In this case,
 the domain number is 0000 and the bus number is 17 (both values are in hex).
@@ -31,7 +30,6 @@ files, each with their own function.
        ----                --------
        class               PCI class (ascii, ro)
        config              PCI config space (binary, rw)
-       detach_state        connection status (bool, rw)
        device              PCI device (ascii, ro)
        irq                 IRQ number (ascii, ro)
        local_cpus          nearby CPU mask (cpumask, ro)
@@ -85,4 +83,4 @@ useful return codes should be provided.
 
 Legacy resources are protected by the HAVE_PCI_LEGACY define.  Platforms
 wishing to support legacy functionality should define it and provide
-pci_legacy_read, pci_legacy_write and pci_mmap_legacy_page_range functions.
\ No newline at end of file
+pci_legacy_read, pci_legacy_write and pci_mmap_legacy_page_range functions.
diff --git a/Documentation/networking/DLINK.txt b/Documentation/networking/DLINK.txt
index 083d24752b83..55d24433d151 100644
--- a/Documentation/networking/DLINK.txt
+++ b/Documentation/networking/DLINK.txt
@@ -178,10 +178,9 @@ Released 1994-06-13
         7. ACKNOWLEDGMENTS.
 
         These drivers wouldn't have been done without the base
-        (and support) from Ross Biro <bir7@leland.stanford.edu>,
-        and D-Link Systems Inc.  The driver relies upon GPL-ed
-        source from D-Link Systems Inc. and from Russel Nelson at
-        Crynwr Software <nelson@crynwr.com>.
+        (and support) from Ross Biro, and D-Link Systems Inc.
+        The driver relies upon GPL-ed source from D-Link Systems Inc.
+        and from Russel Nelson at Crynwr Software <nelson@crynwr.com>.
 
         Additional input also from:
         Donald Becker <becker@super.org>, Alan Cox <A.Cox@swansea.ac.uk>
diff --git a/Documentation/power/devices.txt b/Documentation/power/devices.txt
index 5d4ae9a39f1d..f987afe43e28 100644
--- a/Documentation/power/devices.txt
+++ b/Documentation/power/devices.txt
@@ -207,27 +207,6 @@ SYSTEM_SHUTDOWN, I do not understand this one too much. probably event
 #READY_AFTER_RESUME
 #
 
-Driver Detach Power Management
-
-The kernel now supports the ability to place a device in a low-power
-state when it is detached from its driver, which happens when its
-module is removed. 
-
-Each device contains a 'detach_state' file in its sysfs directory
-which can be used to control this state. Reading from this file
-displays what the current detach state is set to. This is 0 (On) by
-default. A user may write a positive integer value to this file in the
-range of 1-4 inclusive. 
-
-A value of 1-3 will indicate the device should be placed in that
-low-power state, which will cause ->suspend() to be called for that
-device. A value of 4 indicates that the device should be shutdown, so
-->shutdown() will be called for that device. 
-
-The driver is responsible for reinitializing the device when the
-module is re-inserted during it's ->probe() (or equivalent) method. 
-The driver core will not call any extra functions when binding the
-device to the driver. 
 
 pm_message_t meaning
 
diff --git a/Documentation/powerpc/hvcs.txt b/Documentation/powerpc/hvcs.txt
index c0a62e116e6e..dca75cbda6f8 100644
--- a/Documentation/powerpc/hvcs.txt
+++ b/Documentation/powerpc/hvcs.txt
@@ -347,8 +347,8 @@ address that is created by firmware.  An example vty-server sysfs entry
 looks like the following:
 
         Pow5:/sys/bus/vio/drivers/hvcs/30000004 # ls
-        .   current_vty   devspec  name          partner_vtys
-        ..  detach_state  index    partner_clcs  vterm_state
+        .   current_vty   devspec       name          partner_vtys
+        ..  index         partner_clcs  vterm_state
 
 Each entry is provided, by default with a "name" attribute.  Reading the
 "name" attribute will reveal the device type as shown in the following
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 44b6eea60ece..b9e6be00cadf 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -25,6 +25,9 @@ APICs
 
    noapictimer   Don't set up the APIC timer
 
+   no_timer_check Don't check the IO-APIC timer. This can work around
+                 problems with incorrect timer initialization on some boards.
+
 Early Console
 
    syntax: earlyprintk=vga
diff --git a/MAINTAINERS b/MAINTAINERS
index f384a9758fc0..5b8483334de1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1699,7 +1699,9 @@ P:	Pavel Roskin
 M:      proski@gnu.org
 P:      David Gibson
 M:      hermes@gibson.dropbear.id.au
-W:      http://www.ozlabs.org/people/dgibson/dldwd
+L:      orinoco-users@lists.sourceforge.net
+L:      orinoco-devel@lists.sourceforge.net
+W:      http://www.nongnu.org/orinoco/
 S:      Maintained
 
 PARALLEL PORT SUPPORT
diff --git a/Makefile b/Makefile
index f7eb55878f11..1bb028317f2b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 12
-EXTRAVERSION =-rc3
+EXTRAVERSION =-rc4
 NAME=Woozy Numbat
 
 # *DOCUMENTATION*
@@ -530,7 +530,7 @@ endif
 include $(srctree)/arch/$(ARCH)/Makefile
 
 # arch Makefile may override CC so keep this after arch Makefile is included
-NOSTDINC_FLAGS := -nostdinc -isystem $(shell $(CC) -print-file-name=include)
+NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
 CHECKFLAGS     += $(NOSTDINC_FLAGS)
 
 # warn about C99 declaration after statement
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 64e450dddb49..167fd89f8707 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1150,16 +1150,13 @@ osf_usleep_thread(struct timeval32 __user *sleep, struct timeval32 __user *remai
         if (get_tv32(&tmp, sleep))
                 goto fault;
 
-        ticks = tmp.tv_usec;
-        ticks = (ticks + (1000000 / HZ) - 1) / (1000000 / HZ);
-        ticks += tmp.tv_sec * HZ;
+        ticks = timeval_to_jiffies(&tmp);
 
         current->state = TASK_INTERRUPTIBLE;
         ticks = schedule_timeout(ticks);
 
         if (remain) {
-                tmp.tv_sec = ticks / HZ;
-                tmp.tv_usec = ticks % HZ;
+                jiffies_to_timeval(ticks, &tmp);
                 if (put_tv32(remain, &tmp))
                         goto fault;
         }
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 8bfcb37460fa..bf397a9f8ac2 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -85,6 +85,7 @@ choice
 config ARCH_CLPS7500
         bool "Cirrus-CL-PS7500FE"
         select TIMER_ACORN
+        select ISA
 
 config ARCH_CLPS711X
         bool "CLPS711x/EP721x-based"
@@ -96,6 +97,7 @@ config ARCH_CO285
 
 config ARCH_EBSA110
         bool "EBSA-110"
+        select ISA
         help
           This is an evaluation board for the StrongARM processor available
           from Digital. It has limited hardware on-board, including an onboard
@@ -120,13 +122,16 @@ config ARCH_INTEGRATOR
 
 config ARCH_IOP3XX
         bool "IOP3xx-based"
+        select PCI
 
 config ARCH_IXP4XX
         bool "IXP4xx-based"
         select DMABOUNCE
+        select PCI
 
 config ARCH_IXP2000
         bool "IXP2400/2800-based"
+        select PCI
 
 config ARCH_L7200
         bool "LinkUp-L7200"
@@ -155,6 +160,8 @@ config ARCH_RPC
 
 config ARCH_SA1100
         bool "SA1100-based"
+        select ISA
+        select DISCONTIGMEM
 
 config ARCH_S3C2410
         bool "Samsung S3C2410"
@@ -165,6 +172,9 @@ config ARCH_S3C2410
 
 config ARCH_SHARK
         bool "Shark"
+        select ISA
+        select ISA_DMA
+        select PCI
 
 config ARCH_LH7A40X
         bool "Sharp LH7A40X"
@@ -252,8 +262,6 @@ config ARM_AMBA
 
 config ISA
         bool
-        depends on FOOTBRIDGE_HOST || ARCH_SHARK || ARCH_CLPS7500 || ARCH_EBSA110 || ARCH_CDB89712 || ARCH_EDB7211 || ARCH_SA1100 || ARCH_MX1ADS
-        default y
         help
           Find out whether you have ISA slots on your motherboard.  ISA is the
           name of a bus system, i.e. the way the CPU talks to the other stuff
@@ -263,8 +271,6 @@ config ISA
 
 config ISA_DMA
         bool
-        depends on FOOTBRIDGE_HOST || ARCH_SHARK
-        default y
 
 config ISA_DMA_API
         bool
@@ -272,7 +278,6 @@ config ISA_DMA_API
 
 config PCI
         bool "PCI support" if ARCH_INTEGRATOR_AP
-        default y if ARCH_SHARK || FOOTBRIDGE_HOST || ARCH_IOP3XX || ARCH_IXP4XX || ARCH_IXP2000
         help
           Find out whether you have a PCI motherboard. PCI is the name of a
           bus system, i.e. the way the CPU talks to the other stuff inside
@@ -300,7 +305,7 @@ menu "Kernel Features"
 
 config SMP
         bool "Symmetric Multi-Processing (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && n
+        depends on EXPERIMENTAL #&& n
         help
           This enables support for systems with more than one CPU. If you have
           a system with only one CPU, like most personal computers, say N. If
@@ -340,8 +345,7 @@ config PREEMPT
 
 config DISCONTIGMEM
         bool
-        depends on ARCH_EDB7211 || ARCH_SA1100 || (ARCH_LH7A40X && !LH7A40X_CONTIGMEM)
-        default y
+        default (ARCH_LH7A40X && !LH7A40X_CONTIGMEM)
         help
           Say Y to support efficient handling of discontiguous physical memory,
           for architectures which are either NUMA (Non-Uniform Memory Access)
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 080df907f242..4eb36155dc93 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -17,8 +17,8 @@
 
 #include <asm/glue.h>
 #include <asm/vfpmacros.h>
-#include <asm/hardware.h>               @ should be moved into entry-macro.S
-#include <asm/arch/irqs.h>              @ should be moved into entry-macro.S
+#include <asm/hardware.h>               /* should be moved into entry-macro.S */
+#include <asm/arch/irqs.h>              /* should be moved into entry-macro.S */
 #include <asm/arch/entry-macro.S>
 
 #include "entry-header.S"
@@ -505,9 +505,9 @@ ENTRY(__switch_to)
         mra     r4, r5, acc0
         stmia   ip, {r4, r5}
 #endif
-#ifdef CONFIG_HAS_TLS_REG
+#if defined(CONFIG_HAS_TLS_REG)
         mcr     p15, 0, r3, c13, c0, 3          @ set TLS register
-#else
+#elif !defined(CONFIG_TLS_REG_EMUL)
         mov     r4, #0xffff0fff
         str     r3, [r4, #-15]                  @ TLS val at 0xffff0ff0
 #endif
@@ -690,11 +690,7 @@ __kuser_cmpxchg:				@ 0xffff0fc0
 
 __kuser_get_tls:                                @ 0xffff0fe0
 
-#ifndef CONFIG_HAS_TLS_REG
-
-#ifdef CONFIG_SMP  /* sanity check */
-#error "CONFIG_SMP without CONFIG_HAS_TLS_REG is wrong"
-#endif
+#if !defined(CONFIG_HAS_TLS_REG) && !defined(CONFIG_TLS_REG_EMUL)
 
         ldr     r0, [pc, #(16 - 8)]             @ TLS stored at 0xffff0ff0
         mov     pc, lr
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index 171b3e811c71..4733877296d4 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -19,6 +19,7 @@
 #include <asm/procinfo.h>
 #include <asm/ptrace.h>
 #include <asm/constants.h>
+#include <asm/thread_info.h>
 #include <asm/system.h>
 
 #define PROCINFO_MMUFLAGS       8
@@ -131,7 +132,7 @@ __switch_data:
         .long   processor_id                    @ r4
         .long   __machine_arch_type             @ r5
         .long   cr_alignment                    @ r6
-        .long   init_thread_union+8192          @ sp
+        .long   init_thread_union + THREAD_START_SP @ sp
 
 /*
  * The following fragment of code is executed with the MMU on, and uses
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 26eacd3e5def..8f146a4b4752 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -256,8 +256,6 @@ static unsigned long *thread_info_head;
 static unsigned int nr_thread_info;
 
 #define EXTRA_TASK_STRUCT       4
-#define ll_alloc_task_struct() ((struct thread_info *) __get_free_pages(GFP_KERNEL,1))
-#define ll_free_task_struct(p) free_pages((unsigned long)(p),1)
 
 struct thread_info *alloc_thread_info(struct task_struct *task)
 {
@@ -274,17 +272,16 @@ struct thread_info *alloc_thread_info(struct task_struct *task)
         }
 
         if (!thread)
-                thread = ll_alloc_task_struct();
+                thread = (struct thread_info *)
+                           __get_free_pages(GFP_KERNEL, THREAD_SIZE_ORDER);
 
-#ifdef CONFIG_MAGIC_SYSRQ
+#ifdef CONFIG_DEBUG_STACK_USAGE
         /*
          * The stack must be cleared if you want SYSRQ-T to
          * give sensible stack usage information
          */
-        if (thread) {
-                char *p = (char *)thread;
-                memzero(p+KERNEL_STACK_SIZE, KERNEL_STACK_SIZE);
-        }
+        if (thread)
+                memzero(thread, THREAD_SIZE);
 #endif
         return thread;
 }
@@ -297,7 +294,7 @@ void free_thread_info(struct thread_info *thread)
                 thread_info_head = p;
                 nr_thread_info += 1;
         } else
-                ll_free_task_struct(thread);
+                free_pages((unsigned long)thread, THREAD_SIZE_ORDER);
 }
 
 /*
@@ -350,7 +347,7 @@ copy_thread(int nr, unsigned long clone_flags, unsigned long stack_start,
         struct thread_info *thread = p->thread_info;
         struct pt_regs *childregs;
 
-        childregs = ((struct pt_regs *)((unsigned long)thread + THREAD_SIZE - 8)) - 1;
+        childregs = ((struct pt_regs *)((unsigned long)thread + THREAD_START_SP)) - 1;
         *childregs = *regs;
         childregs->ARM_r0 = 0;
         childregs->ARM_sp = stack_start;
@@ -447,15 +444,17 @@ EXPORT_SYMBOL(kernel_thread);
 unsigned long get_wchan(struct task_struct *p)
 {
         unsigned long fp, lr;
-        unsigned long stack_page;
+        unsigned long stack_start, stack_end;
         int count = 0;
         if (!p || p == current || p->state == TASK_RUNNING)
                 return 0;
 
-        stack_page = 4096 + (unsigned long)p->thread_info;
+        stack_start = (unsigned long)(p->thread_info + 1);
+        stack_end = ((unsigned long)p->thread_info) + THREAD_SIZE;
+
         fp = thread_saved_fp(p);
         do {
-                if (fp < stack_page || fp > 4092+stack_page)
+                if (fp < stack_start || fp > stack_end)
                         return 0;
                 lr = pc_pointer (((unsigned long *)fp)[-1]);
                 if (!in_sched_functions(lr))
diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
index ef32577da304..f897ce2ccf0d 100644
--- a/arch/arm/kernel/sys_arm.c
+++ b/arch/arm/kernel/sys_arm.c
@@ -302,7 +302,7 @@ long execve(const char *filename, char **argv, char **envp)
                 "b      ret_to_user"
                 :
                 : "r" (current_thread_info()),
-                  "Ir" (THREAD_SIZE - 8 - sizeof(regs)),
+                  "Ir" (THREAD_START_SP - sizeof(regs)),
                   "r" (&regs),
                   "Ir" (sizeof(regs))
                 : "r0", "r1", "r2", "r3", "ip", "memory");
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 3a001fe5540b..14df16b983f4 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -218,7 +218,8 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
                 tsk->comm, tsk->pid, tsk->thread_info + 1);
 
         if (!user_mode(regs) || in_interrupt()) {
-                dump_mem("Stack: ", regs->ARM_sp, 8192+(unsigned long)tsk->thread_info);
+                dump_mem("Stack: ", regs->ARM_sp,
+                         THREAD_SIZE + (unsigned long)tsk->thread_info);
                 dump_backtrace(regs, tsk);
                 dump_instr(regs);
         }
@@ -450,9 +451,9 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
 
         case NR(set_tls):
                 thread->tp_value = regs->ARM_r0;
-#ifdef CONFIG_HAS_TLS_REG
+#if defined(CONFIG_HAS_TLS_REG)
                 asm ("mcr p15, 0, %0, c13, c0, 3" : : "r" (regs->ARM_r0) );
-#else
+#elif !defined(CONFIG_TLS_REG_EMUL)
                 /*
                  * User space must never try to access this directly.
                  * Expect your app to break eventually if you do so.
@@ -497,11 +498,14 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
         return 0;
 }
 
-#if defined(CONFIG_CPU_32v6) && !defined(CONFIG_HAS_TLS_REG)
+#ifdef CONFIG_TLS_REG_EMUL
 
 /*
  * We might be running on an ARMv6+ processor which should have the TLS
- * register, but for some reason we can't use it and have to emulate it.
+ * register but for some reason we can't use it, or maybe an SMP system
+ * using a pre-ARMv6 processor (there are apparently a few prototypes like
+ * that in existence) and therefore access to that register must be
+ * emulated.
  */
 
 static int get_tp_trap(struct pt_regs *regs, unsigned int instr)
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index a39c6a42d68a..ad2d66c93a5c 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -5,6 +5,7 @@
 
 #include <asm-generic/vmlinux.lds.h>
 #include <linux/config.h>
+#include <asm/thread_info.h>
         
 OUTPUT_ARCH(arm)
 ENTRY(stext)
@@ -103,7 +104,7 @@ SECTIONS
         __data_loc = ALIGN(4);          /* location in binary */
         . = DATAADDR;
 #else
-        . = ALIGN(8192);
+        . = ALIGN(THREAD_SIZE);
         __data_loc = .;
 #endif
 
diff --git a/arch/arm/mach-clps711x/Kconfig b/arch/arm/mach-clps711x/Kconfig
index f6e676322ca9..45c930ccd064 100644
--- a/arch/arm/mach-clps711x/Kconfig
+++ b/arch/arm/mach-clps711x/Kconfig
@@ -10,6 +10,7 @@ config ARCH_AUTCPU12
 
 config ARCH_CDB89712
         bool "CDB89712"
+        select ISA
         help
           This is an evaluation board from Cirrus for the CS89712 processor.
           The board includes 2 serial ports, Ethernet, IRDA, and expansion
@@ -26,6 +27,8 @@ config ARCH_CLEP7312
 
 config ARCH_EDB7211
         bool "EDB7211"
+        select ISA
+        select DISCONTIGMEM
         help
           Say Y here if you intend to run this kernel on a Cirrus Logic EDB-7211
           evaluation board.
diff --git a/arch/arm/mach-footbridge/Kconfig b/arch/arm/mach-footbridge/Kconfig
index 1090c680b6dd..324d9edeec38 100644
--- a/arch/arm/mach-footbridge/Kconfig
+++ b/arch/arm/mach-footbridge/Kconfig
@@ -5,6 +5,9 @@ menu "Footbridge Implementations"
 config ARCH_CATS
         bool "CATS"
         select FOOTBRIDGE_HOST
+        select ISA
+        select ISA_DMA
+        select PCI
         help
           Say Y here if you intend to run this kernel on the CATS.
 
@@ -13,6 +16,9 @@ config ARCH_CATS
 config ARCH_PERSONAL_SERVER
         bool "Compaq Personal Server"
         select FOOTBRIDGE_HOST
+        select ISA
+        select ISA_DMA
+        select PCI
         ---help---
           Say Y here if you intend to run this kernel on the Compaq
           Personal Server.
@@ -42,6 +48,9 @@ config ARCH_EBSA285_HOST
         bool "EBSA285 (host mode)"
         select ARCH_EBSA285
         select FOOTBRIDGE_HOST
+        select ISA
+        select ISA_DMA
+        select PCI
         help
           Say Y here if you intend to run this kernel on the EBSA285 card
           in host ("central function") mode.
@@ -51,6 +60,9 @@ config ARCH_EBSA285_HOST
 config ARCH_NETWINDER
         bool "NetWinder"
         select FOOTBRIDGE_HOST
+        select ISA
+        select ISA_DMA
+        select PCI
         help
           Say Y here if you intend to run this kernel on the Rebel.COM
           NetWinder.  Information about this machine can be found at:
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index ec85813ee5dc..cddd194ac6eb 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -4,6 +4,7 @@ menu "IMX Implementations"
 config ARCH_MX1ADS
         bool "mx1ads"
         depends on ARCH_IMX
+        select ISA
         help
           Say Y here if you are using the Motorola MX1ADS board
 
diff --git a/arch/arm/mach-s3c2410/clock.c b/arch/arm/mach-s3c2410/clock.c
index e23f534d4e1d..8d986b8401c2 100644
--- a/arch/arm/mach-s3c2410/clock.c
+++ b/arch/arm/mach-s3c2410/clock.c
@@ -478,7 +478,7 @@ static int s3c2440_clk_add(struct sys_device *sysdev)
 {
         unsigned long upllcon = __raw_readl(S3C2410_UPLLCON);
 
-        s3c2440_clk_upll.rate = s3c2410_get_pll(upllcon, clk_xtal.rate) * 2;
+        s3c2440_clk_upll.rate = s3c2410_get_pll(upllcon, clk_xtal.rate);
 
         printk("S3C2440: Clock Support, UPLL %ld.%03ld MHz\n",
                print_mhz(s3c2440_clk_upll.rate));
diff --git a/arch/arm/mach-s3c2410/s3c2440.c b/arch/arm/mach-s3c2410/s3c2440.c
index 9a8cc5ae2255..d4c8281b55f6 100644
--- a/arch/arm/mach-s3c2410/s3c2440.c
+++ b/arch/arm/mach-s3c2410/s3c2440.c
@@ -192,9 +192,11 @@ void __init s3c2440_map_io(struct map_desc *mach_desc, int size)
 
         iotable_init(s3c2440_iodesc, ARRAY_SIZE(s3c2440_iodesc));
         iotable_init(mach_desc, size);
+
         /* rename any peripherals used differing from the s3c2410 */
 
-        s3c_device_i2c.name = "s3c2440-i2c";
+        s3c_device_i2c.name  = "s3c2440-i2c";
+        s3c_device_nand.name = "s3c2440-nand";
 
         /* change irq for watchdog */
 
@@ -225,7 +227,7 @@ void __init s3c2440_init_clocks(int xtal)
                 break;
 
         case S3C2440_CLKDIVN_HDIVN_2:
-                hdiv = 1;
+                hdiv = 2;
                 break;
 
         case S3C2440_CLKDIVN_HDIVN_4_8:
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 27892e34b060..48bac7da8c70 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -410,17 +410,22 @@ config CPU_BPREDICT_DISABLE
         help
           Say Y here to disable branch prediction.  If unsure, say N.
 
+config TLS_REG_EMUL
+        bool
+        default y if SMP && (CPU_32v5 || CPU_32v4 || CPU_32v3)
+        help
+          An SMP system using a pre-ARMv6 processor (there are apparently
+          a few prototypes like that in existence) and therefore access to
+          that required register must be emulated.
+
 config HAS_TLS_REG
         bool
-        depends on CPU_32v6 && !CPU_32v5 && !CPU_32v4 && !CPU_32v3
-        default y
+        depends on !TLS_REG_EMUL
+        default y if SMP || CPU_32v7
         help
           This selects support for the CP15 thread register.
-          It is defined to be available on ARMv6 or later.  However
-          if the kernel is configured to support multiple CPUs including
-          a pre-ARMv6 processors, or if a given ARMv6 processor doesn't
-          implement the thread register for some reason, then access to
-          this register from user space must be trapped and emulated.
-          If user space is relying on the __kuser_get_tls code then
-          there should not be any impact.
+          It is defined to be available on some ARMv6 processors (including
+          all SMP capable ARMv6's) or later processors.  User space may
+          assume directly accessing that register and always obtain the
+          expected value only on ARMv7 and above.
 
diff --git a/arch/arm/mm/copypage-v4mc.S b/arch/arm/mm/copypage-v4mc.S
deleted file mode 100644
index 305af3dab3d8..000000000000
--- a/arch/arm/mm/copypage-v4mc.S
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- *  linux/arch/arm/lib/copy_page-armv4mc.S
- *
- *  Copyright (C) 1995-2001 Russell King
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- *  ASM optimised string functions
- */
-#include <linux/linkage.h>
-#include <linux/init.h>
-#include <asm/constants.h>
-
-        .text
-        .align  5
-/*
- * ARMv4 mini-dcache optimised copy_user_page
- *
- * We flush the destination cache lines just before we write the data into the
- * corresponding address.  Since the Dcache is read-allocate, this removes the
- * Dcache aliasing issue.  The writes will be forwarded to the write buffer,
- * and merged as appropriate.
- *
- * Note: We rely on all ARMv4 processors implementing the "invalidate D line"
- * instruction.  If your processor does not supply this, you have to write your
- * own copy_user_page that does the right thing.
- */
-ENTRY(v4_mc_copy_user_page)
-        stmfd   sp!, {r4, lr}                   @ 2
-        mov     r4, r0
-        mov     r0, r1
-        bl      map_page_minicache
-        mov     r1, #PAGE_SZ/64                 @ 1
-        ldmia   r0!, {r2, r3, ip, lr}           @ 4
-1:      mcr     p15, 0, r4, c7, c6, 1           @ 1   invalidate D line
-        stmia   r4!, {r2, r3, ip, lr}           @ 4
-        ldmia   r0!, {r2, r3, ip, lr}           @ 4+1
-        stmia   r4!, {r2, r3, ip, lr}           @ 4
-        ldmia   r0!, {r2, r3, ip, lr}           @ 4
-        mcr     p15, 0, r4, c7, c6, 1           @ 1   invalidate D line
-        stmia   r4!, {r2, r3, ip, lr}           @ 4
-        ldmia   r0!, {r2, r3, ip, lr}           @ 4
-        subs    r1, r1, #1                      @ 1
-        stmia   r4!, {r2, r3, ip, lr}           @ 4
-        ldmneia r0!, {r2, r3, ip, lr}           @ 4
-        bne     1b                              @ 1
-        ldmfd   sp!, {r4, pc}                   @ 3
-
-        .align  5
-/*
- * ARMv4 optimised clear_user_page
- *
- * Same story as above.
- */
-ENTRY(v4_mc_clear_user_page)
-        str     lr, [sp, #-4]!
-        mov     r1, #PAGE_SZ/64                 @ 1
-        mov     r2, #0                          @ 1
-        mov     r3, #0                          @ 1
-        mov     ip, #0                          @ 1
-        mov     lr, #0                          @ 1
-1:      mcr     p15, 0, r0, c7, c6, 1           @ 1   invalidate D line
-        stmia   r0!, {r2, r3, ip, lr}           @ 4
-        stmia   r0!, {r2, r3, ip, lr}           @ 4
-        mcr     p15, 0, r0, c7, c6, 1           @ 1   invalidate D line
-        stmia   r0!, {r2, r3, ip, lr}           @ 4
-        stmia   r0!, {r2, r3, ip, lr}           @ 4
-        subs    r1, r1, #1                      @ 1
-        bne     1b                              @ 1
-        ldr     pc, [sp], #4
-
-        __INITDATA
-
-        .type   v4_mc_user_fns, #object
-ENTRY(v4_mc_user_fns)
-        .long   v4_mc_clear_user_page
-        .long   v4_mc_copy_user_page
-        .size   v4_mc_user_fns, . - v4_mc_user_fns
diff --git a/arch/arm/mm/copypage-v4mc.c b/arch/arm/mm/copypage-v4mc.c
new file mode 100644
index 000000000000..fc69dccdace1
--- /dev/null
+++ b/arch/arm/mm/copypage-v4mc.c
@@ -0,0 +1,111 @@
+/*
+ *  linux/arch/arm/lib/copypage-armv4mc.S
+ *
+ *  Copyright (C) 1995-2005 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This handles the mini data cache, as found on SA11x0 and XScale
+ * processors.  When we copy a user page page, we map it in such a way
+ * that accesses to this page will not touch the main data cache, but
+ * will be cached in the mini data cache.  This prevents us thrashing
+ * the main data cache on page faults.
+ */
+#include <linux/init.h>
+#include <linux/mm.h>
+
+#include <asm/page.h>
+#include <asm/pgtable.h>
+#include <asm/tlbflush.h>
+
+/*
+ * 0xffff8000 to 0xffffffff is reserved for any ARM architecture
+ * specific hacks for copying pages efficiently.
+ */
+#define minicache_pgprot __pgprot(L_PTE_PRESENT | L_PTE_YOUNG | \
+                                  L_PTE_CACHEABLE)
+
+#define TOP_PTE(x)      pte_offset_kernel(top_pmd, x)
+
+static DEFINE_SPINLOCK(minicache_lock);
+
+/*
+ * ARMv4 mini-dcache optimised copy_user_page
+ *
+ * We flush the destination cache lines just before we write the data into the
+ * corresponding address.  Since the Dcache is read-allocate, this removes the
+ * Dcache aliasing issue.  The writes will be forwarded to the write buffer,
+ * and merged as appropriate.
+ *
+ * Note: We rely on all ARMv4 processors implementing the "invalidate D line"
+ * instruction.  If your processor does not supply this, you have to write your
+ * own copy_user_page that does the right thing.
+ */
+static void __attribute__((naked))
+mc_copy_user_page(void *from, void *to)
+{
+        asm volatile(
+        "stmfd  sp!, {r4, lr}                   @ 2\n\
+        mov     r4, %2                          @ 1\n\
+        ldmia   %0!, {r2, r3, ip, lr}           @ 4\n\
+1:      mcr     p15, 0, %1, c7, c6, 1           @ 1   invalidate D line\n\
+        stmia   %1!, {r2, r3, ip, lr}           @ 4\n\
+        ldmia   %0!, {r2, r3, ip, lr}           @ 4+1\n\
+        stmia   %1!, {r2, r3, ip, lr}           @ 4\n\
+        ldmia   %0!, {r2, r3, ip, lr}           @ 4\n\
+        mcr     p15, 0, %1, c7, c6, 1           @ 1   invalidate D line\n\
+        stmia   %1!, {r2, r3, ip, lr}           @ 4\n\
+        ldmia   %0!, {r2, r3, ip, lr}           @ 4\n\
+        subs    r4, r4, #1                      @ 1\n\
+        stmia   %1!, {r2, r3, ip, lr}           @ 4\n\
+        ldmneia %0!, {r2, r3, ip, lr}           @ 4\n\
+        bne     1b                              @ 1\n\
+        ldmfd   sp!, {r4, pc}                   @ 3"
+        :
+        : "r" (from), "r" (to), "I" (PAGE_SIZE / 64));
+}
+
+void v4_mc_copy_user_page(void *kto, const void *kfrom, unsigned long vaddr)
+{
+        spin_lock(&minicache_lock);
+
+        set_pte(TOP_PTE(0xffff8000), pfn_pte(__pa(kfrom) >> PAGE_SHIFT, minicache_pgprot));
+        flush_tlb_kernel_page(0xffff8000);
+
+        mc_copy_user_page((void *)0xffff8000, kto);
+
+        spin_unlock(&minicache_lock);
+}
+
+/*
+ * ARMv4 optimised clear_user_page
+ */
+void __attribute__((naked))
+v4_mc_clear_user_page(void *kaddr, unsigned long vaddr)
+{
+        asm volatile(
+        "str    lr, [sp, #-4]!\n\
+        mov     r1, %0                          @ 1\n\
+        mov     r2, #0                          @ 1\n\
+        mov     r3, #0                          @ 1\n\
+        mov     ip, #0                          @ 1\n\
+        mov     lr, #0                          @ 1\n\
+1:      mcr     p15, 0, r0, c7, c6, 1           @ 1   invalidate D line\n\
+        stmia   r0!, {r2, r3, ip, lr}           @ 4\n\
+        stmia   r0!, {r2, r3, ip, lr}           @ 4\n\
+        mcr     p15, 0, r0, c7, c6, 1           @ 1   invalidate D line\n\
+        stmia   r0!, {r2, r3, ip, lr}           @ 4\n\
+        stmia   r0!, {r2, r3, ip, lr}           @ 4\n\
+        subs    r1, r1, #1                      @ 1\n\
+        bne     1b                              @ 1\n\
+        ldr     pc, [sp], #4"
+        :
+        : "I" (PAGE_SIZE / 64));
+}
+
+struct cpu_user_fns v4_mc_user_fns __initdata = {
+        .cpu_clear_user_page    = v4_mc_clear_user_page, 
+        .cpu_copy_user_page     = v4_mc_copy_user_page,
+};
diff --git a/arch/arm/mm/copypage-v6.c b/arch/arm/mm/copypage-v6.c
index 694ac8208858..a8c00236bd3d 100644
--- a/arch/arm/mm/copypage-v6.c
+++ b/arch/arm/mm/copypage-v6.c
@@ -26,8 +26,8 @@
 #define to_address      (0xffffc000)
 #define to_pgprot       PAGE_KERNEL
 
-static pte_t *from_pte;
-static pte_t *to_pte;
+#define TOP_PTE(x)      pte_offset_kernel(top_pmd, x)
+
 static DEFINE_SPINLOCK(v6_lock);
 
 #define DCACHE_COLOUR(vaddr) ((vaddr & (SHMLBA - 1)) >> PAGE_SHIFT)
@@ -74,8 +74,8 @@ void v6_copy_user_page_aliasing(void *kto, const void *kfrom, unsigned long vadd
          */
         spin_lock(&v6_lock);
 
-        set_pte(from_pte + offset, pfn_pte(__pa(kfrom) >> PAGE_SHIFT, from_pgprot));
-        set_pte(to_pte + offset, pfn_pte(__pa(kto) >> PAGE_SHIFT, to_pgprot));
+        set_pte(TOP_PTE(from_address) + offset, pfn_pte(__pa(kfrom) >> PAGE_SHIFT, from_pgprot));
+        set_pte(TOP_PTE(to_address) + offset, pfn_pte(__pa(kto) >> PAGE_SHIFT, to_pgprot));
 
         from = from_address + (offset << PAGE_SHIFT);
         to   = to_address + (offset << PAGE_SHIFT);
@@ -114,7 +114,7 @@ void v6_clear_user_page_aliasing(void *kaddr, unsigned long vaddr)
          */
         spin_lock(&v6_lock);
 
-        set_pte(to_pte + offset, pfn_pte(__pa(kaddr) >> PAGE_SHIFT, to_pgprot));
+        set_pte(TOP_PTE(to_address) + offset, pfn_pte(__pa(kaddr) >> PAGE_SHIFT, to_pgprot));
         flush_tlb_kernel_page(to);
         clear_page((void *)to);
 
@@ -129,21 +129,6 @@ struct cpu_user_fns v6_user_fns __initdata = {
 static int __init v6_userpage_init(void)
 {
         if (cache_is_vipt_aliasing()) {
-                pgd_t *pgd;
-                pmd_t *pmd;
-
-                pgd = pgd_offset_k(from_address);
-                pmd = pmd_alloc(&init_mm, pgd, from_address);
-                if (!pmd)
-                        BUG();
-                from_pte = pte_alloc_kernel(&init_mm, pmd, from_address);
-                if (!from_pte)
-                        BUG();
-
-                to_pte = pte_alloc_kernel(&init_mm, pmd, to_address);
-                if (!to_pte)
-                        BUG();
-
                 cpu_user.cpu_clear_user_page = v6_clear_user_page_aliasing;
                 cpu_user.cpu_copy_user_page = v6_copy_user_page_aliasing;
         }
@@ -151,5 +136,4 @@ static int __init v6_userpage_init(void)
         return 0;
 }
 
-__initcall(v6_userpage_init);
-
+core_initcall(v6_userpage_init);
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index c6de48d89503..4085ed983e46 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -13,6 +13,29 @@
 
 #include <asm/cacheflush.h>
 #include <asm/system.h>
+#include <asm/tlbflush.h>
+
+#ifdef CONFIG_CPU_CACHE_VIPT
+#define ALIAS_FLUSH_START       0xffff4000
+
+#define TOP_PTE(x)      pte_offset_kernel(top_pmd, x)
+
+static void flush_pfn_alias(unsigned long pfn, unsigned long vaddr)
+{
+        unsigned long to = ALIAS_FLUSH_START + (CACHE_COLOUR(vaddr) << PAGE_SHIFT);
+
+        set_pte(TOP_PTE(to), pfn_pte(pfn, PAGE_KERNEL));
+        flush_tlb_kernel_page(to);
+
+        asm(    "mcrr   p15, 0, %1, %0, c14\n"
+        "       mcrr    p15, 0, %1, %0, c5\n"
+            :
+            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES)
+            : "cc");
+}
+#else
+#define flush_pfn_alias(pfn,vaddr)      do { } while (0)
+#endif
 
 static void __flush_dcache_page(struct address_space *mapping, struct page *page)
 {
@@ -37,6 +60,18 @@ static void __flush_dcache_page(struct address_space *mapping, struct page *page
                 return;
 
         /*
+         * This is a page cache page.  If we have a VIPT cache, we
+         * only need to do one flush - which would be at the relevant
+         * userspace colour, which is congruent with page->index.
+         */
+        if (cache_is_vipt()) {
+                if (cache_is_vipt_aliasing())
+                        flush_pfn_alias(page_to_pfn(page),
+                                        page->index << PAGE_CACHE_SHIFT);
+                return;
+        }
+
+        /*
          * There are possible user space mappings of this page:
          * - VIVT cache: we need to also write back and invalidate all user
          *   data in the current VM view associated with this page.
@@ -57,8 +92,6 @@ static void __flush_dcache_page(struct address_space *mapping, struct page *page
                         continue;
                 offset = (pgoff - mpnt->vm_pgoff) << PAGE_SHIFT;
                 flush_cache_page(mpnt, mpnt->vm_start + offset, page_to_pfn(page));
-                if (cache_is_vipt())
-                        break;
         }
         flush_dcache_mmap_unlock(mapping);
 }
diff --git a/arch/arm/mm/mm-armv.c b/arch/arm/mm/mm-armv.c
index 585dfb8e20b9..2c2b93d77d43 100644
--- a/arch/arm/mm/mm-armv.c
+++ b/arch/arm/mm/mm-armv.c
@@ -37,6 +37,8 @@ pgprot_t pgprot_kernel;
 
 EXPORT_SYMBOL(pgprot_kernel);
 
+pmd_t *top_pmd;
+
 struct cachepolicy {
         const char      policy[16];
         unsigned int    cr_mask;
@@ -142,6 +144,16 @@ __setup("noalign", noalign_setup);
 
 #define FIRST_KERNEL_PGD_NR     (FIRST_USER_PGD_NR + USER_PTRS_PER_PGD)
 
+static inline pmd_t *pmd_off(pgd_t *pgd, unsigned long virt)
+{
+        return pmd_offset(pgd, virt);
+}
+
+static inline pmd_t *pmd_off_k(unsigned long virt)
+{
+        return pmd_off(pgd_offset_k(virt), virt);
+}
+
 /*
  * need to get a 16k page for level 1
  */
@@ -220,7 +232,7 @@ void free_pgd_slow(pgd_t *pgd)
                 return;
 
         /* pgd is always present and good */
-        pmd = (pmd_t *)pgd;
+        pmd = pmd_off(pgd, 0);
         if (pmd_none(*pmd))
                 goto free;
         if (pmd_bad(*pmd)) {
@@ -246,9 +258,8 @@ free:
 static inline void
 alloc_init_section(unsigned long virt, unsigned long phys, int prot)
 {
-        pmd_t *pmdp;
+        pmd_t *pmdp = pmd_off_k(virt);
 
-        pmdp = pmd_offset(pgd_offset_k(virt), virt);
         if (virt & (1 << 20))
                 pmdp++;
 
@@ -283,11 +294,9 @@ alloc_init_supersection(unsigned long virt, unsigned long phys, int prot)
 static inline void
 alloc_init_page(unsigned long virt, unsigned long phys, unsigned int prot_l1, pgprot_t prot)
 {
-        pmd_t *pmdp;
+        pmd_t *pmdp = pmd_off_k(virt);
         pte_t *ptep;
 
-        pmdp = pmd_offset(pgd_offset_k(virt), virt);
-
         if (pmd_none(*pmdp)) {
                 unsigned long pmdval;
                 ptep = alloc_bootmem_low_pages(2 * PTRS_PER_PTE *
@@ -310,7 +319,7 @@ alloc_init_page(unsigned long virt, unsigned long phys, unsigned int prot_l1, pg
  */
 static inline void clear_mapping(unsigned long virt)
 {
-        pmd_clear(pmd_offset(pgd_offset_k(virt), virt));
+        pmd_clear(pmd_off_k(virt));
 }
 
 struct mem_types {
@@ -578,7 +587,7 @@ void setup_mm_for_reboot(char mode)
                          PMD_TYPE_SECT;
                 if (cpu_arch <= CPU_ARCH_ARMv5)
                         pmdval |= PMD_BIT4;
-                pmd = pmd_offset(pgd + i, i << PGDIR_SHIFT);
+                pmd = pmd_off(pgd, i << PGDIR_SHIFT);
                 pmd[0] = __pmd(pmdval);
                 pmd[1] = __pmd(pmdval + (1 << (PGDIR_SHIFT - 1)));
                 flush_pmd_entry(pmd);
@@ -675,6 +684,8 @@ void __init memtable_init(struct meminfo *mi)
 
         flush_cache_all();
         flush_tlb_all();
+
+        top_pmd = pmd_off_k(0xffff0000);
 }
 
 /*
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index fee589119606..e382f32d435e 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -183,7 +183,7 @@ config M386
           - "Winchip-C6" for original IDT Winchip.
           - "Winchip-2" for IDT Winchip 2.
           - "Winchip-2A" for IDT Winchips with 3dNow! capabilities.
-          - "MediaGX/Geode" for Cyrix MediaGX aka Geode.
+          - "GeodeGX1" for Geode GX1 (Cyrix MediaGX).
           - "CyrixIII/VIA C3" for VIA Cyrix III or VIA C3.
           - "VIA C3-2 for VIA C3-2 "Nehemiah" (model 9 and above).
 
@@ -311,12 +311,10 @@ config MWINCHIP3D
           stores for this CPU, which can increase performance of some
           operations.
 
-config MGEODE
-        bool "MediaGX/Geode"
+config MGEODEGX1
+        bool "GeodeGX1"
         help
-          Select this for a Cyrix MediaGX aka Geode chip. Linux and GCC
-          treat this chip as a 586TSC with some extended instructions
-          and alignment reqirements.
+          Select this for a Geode GX1 (Cyrix MediaGX) chip.
 
 config MCYRIXIII
         bool "CyrixIII/VIA-C3"
@@ -368,7 +366,7 @@ config X86_L1_CACHE_SHIFT
         int
         default "7" if MPENTIUM4 || X86_GENERIC
         default "4" if X86_ELAN || M486 || M386
-        default "5" if MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE
+        default "5" if MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODEGX1
         default "6" if MK7 || MK8 || MPENTIUMM
 
 config RWSEM_GENERIC_SPINLOCK
@@ -387,7 +385,7 @@ config GENERIC_CALIBRATE_DELAY
 
 config X86_PPRO_FENCE
         bool
-        depends on M686 || M586MMX || M586TSC || M586 || M486 || M386 || MGEODE
+        depends on M686 || M586MMX || M586TSC || M586 || M486 || M386 || MGEODEGX1
         default y
 
 config X86_F00F_BUG
@@ -417,7 +415,7 @@ config X86_POPAD_OK
 
 config X86_ALIGNMENT_16
         bool
-        depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODE
+        depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
         default y
 
 config X86_GOOD_APIC
@@ -442,7 +440,7 @@ config X86_USE_3DNOW
 
 config X86_OOSTORE
         bool
-        depends on (MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MGEODE) && MTRR
+        depends on (MWINCHIP3D || MWINCHIP2 || MWINCHIPC6) && MTRR
         default y
 
 config HPET_TIMER
@@ -578,7 +576,7 @@ config X86_VISWS_APIC
 
 config X86_TSC
         bool
-        depends on (MWINCHIP3D || MWINCHIP2 || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MGEODE) && !X86_NUMAQ
+        depends on (MWINCHIP3D || MWINCHIP2 || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MGEODEGX1) && !X86_NUMAQ
         default y
 
 config X86_MCE
diff --git a/arch/i386/Makefile b/arch/i386/Makefile
index 04783ceb050c..1c36ca332a96 100644
--- a/arch/i386/Makefile
+++ b/arch/i386/Makefile
@@ -14,7 +14,7 @@
 # 19990713  Artur Skawina <skawina@geocities.com>
 #           Added '-march' and '-mpreferred-stack-boundary' support
 #
-#           Kianusch Sayah Karadji <kianusch@sk-tech.net>
+# 20050320  Kianusch Sayah Karadji <kianusch@sk-tech.net>
 #           Added support for GEODE CPU
 
 LDFLAGS         := -m elf_i386
@@ -54,8 +54,8 @@ cflags-$(CONFIG_MVIAC3_2)	+= $(call cc-option,-march=c3-2,-march=i686)
 # AMD Elan support
 cflags-$(CONFIG_X86_ELAN)       += -march=i486
 
-# MediaGX aka Geode support
-cflags-$(CONFIG_MGEODE)         += $(call cc-option,-march=pentium-mmx,-march=i586)
+# Geode GX1 support
+cflags-$(CONFIG_MGEODEGX1)              += $(call cc-option,-march=pentium-mmx,-march=i486)
 
 # -mregparm=3 works ok on gcc-3.0 and later
 #
diff --git a/arch/i386/boot/bootsect.S b/arch/i386/boot/bootsect.S
index ba9fe14db6a9..011b7a4993d4 100644
--- a/arch/i386/boot/bootsect.S
+++ b/arch/i386/boot/bootsect.S
@@ -83,7 +83,7 @@ bugger_off_msg:
         .ascii  "\n"
         .ascii  "Remove disk and press any key to reboot . . .\r\n"
         .byte   0
-        
+
 
         # Kernel attributes; used by setup
 
diff --git a/arch/i386/boot/video.S b/arch/i386/boot/video.S
index 925d3f5a3824..0587477c99f2 100644
--- a/arch/i386/boot/video.S
+++ b/arch/i386/boot/video.S
@@ -1924,36 +1924,36 @@ skip10:	movb	%ah, %al
         ret
 
 store_edid:
-        pushw   %es                             # just save all registers 
-        pushw   %ax                             
+        pushw   %es                             # just save all registers
+        pushw   %ax
         pushw   %bx
         pushw   %cx
         pushw   %dx
         pushw   %di
 
-        pushw   %fs                             
+        pushw   %fs
         popw    %es
 
         movl    $0x13131313, %eax               # memset block with 0x13
         movw    $32, %cx
         movw    $0x140, %di
         cld
-        rep 
-        stosl  
+        rep
+        stosl
 
-        movw    $0x4f15, %ax                    # do VBE/DDC 
+        movw    $0x4f15, %ax                    # do VBE/DDC
         movw    $0x01, %bx
         movw    $0x00, %cx
         movw    $0x01, %dx
         movw    $0x140, %di
-        int     $0x10   
+        int     $0x10
 
-        popw    %di                             # restore all registers        
+        popw    %di                             # restore all registers
         popw    %dx
         popw    %cx
         popw    %bx
         popw    %ax
-        popw    %es     
+        popw    %es
         ret
 
 # VIDEO_SELECT-only variables
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 53eb5cfd5b63..848bb97af7ca 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -650,7 +650,7 @@ acpi_find_rsdp (void)
          */
         rsdp_phys = acpi_scan_rsdp (0, 0x400);
         if (!rsdp_phys)
-                rsdp_phys = acpi_scan_rsdp (0xE0000, 0xFFFFF);
+                rsdp_phys = acpi_scan_rsdp (0xE0000, 0x20000);
 
         return rsdp_phys;
 }
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index 16dbc4151be4..73aeaf5a9d4e 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -24,9 +24,6 @@ __asm__(".align 4\nvide: ret");
 
 static void __init init_amd(struct cpuinfo_x86 *c)
 {
-#ifdef CONFIG_X86_SMP
-        int cpu = c == &boot_cpu_data ? 0 : c - cpu_data;
-#endif
         u32 l, h;
         int mbytes = num_physpages >> (20-PAGE_SHIFT);
         int r;
@@ -198,14 +195,19 @@ static void __init init_amd(struct cpuinfo_x86 *c)
                         c->x86_num_cores = 1;
         }
 
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_X86_HT
         /*
          * On a AMD dual core setup the lower bits of the APIC id
          * distingush the cores.  Assumes number of cores is a power
          * of two.
          */
         if (c->x86_num_cores > 1) {
-                cpu_core_id[cpu] = cpu >> hweight32(c->x86_num_cores - 1);
+                int cpu = smp_processor_id();
+                unsigned bits = 0;
+                while ((1 << bits) < c->x86_num_cores)
+                        bits++;
+                cpu_core_id[cpu] = phys_proc_id[cpu] & ((1<<bits)-1);
+                phys_proc_id[cpu] >>= bits;
                 printk(KERN_INFO "CPU %d(%d) -> Core %d\n",
                        cpu, c->x86_num_cores, cpu_core_id[cpu]);
         }
diff --git a/arch/i386/kernel/cpu/common.c b/arch/i386/kernel/cpu/common.c
index 6be0310e3cd3..d199e525680a 100644
--- a/arch/i386/kernel/cpu/common.c
+++ b/arch/i386/kernel/cpu/common.c
@@ -243,6 +243,10 @@ static void __init early_cpu_detect(void)
         }
 
         early_intel_workaround(c);
+
+#ifdef CONFIG_X86_HT
+        phys_proc_id[smp_processor_id()] = (cpuid_ebx(1) >> 24) & 0xff;
+#endif
 }
 
 void __init generic_identify(struct cpuinfo_x86 * c)
diff --git a/arch/i386/kernel/cpu/mtrr/cyrix.c b/arch/i386/kernel/cpu/mtrr/cyrix.c
index 933b0dd62f48..9027a987006b 100644
--- a/arch/i386/kernel/cpu/mtrr/cyrix.c
+++ b/arch/i386/kernel/cpu/mtrr/cyrix.c
@@ -218,12 +218,12 @@ typedef struct {
         mtrr_type type;
 } arr_state_t;
 
-static arr_state_t arr_state[8] __initdata = {
+static arr_state_t arr_state[8] __devinitdata = {
         {0UL, 0UL, 0UL}, {0UL, 0UL, 0UL}, {0UL, 0UL, 0UL}, {0UL, 0UL, 0UL},
         {0UL, 0UL, 0UL}, {0UL, 0UL, 0UL}, {0UL, 0UL, 0UL}, {0UL, 0UL, 0UL}
 };
 
-static unsigned char ccr_state[7] __initdata = { 0, 0, 0, 0, 0, 0, 0 };
+static unsigned char ccr_state[7] __devinitdata = { 0, 0, 0, 0, 0, 0, 0 };
 
 static void cyrix_set_all(void)
 {
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index 14ec354bec92..903190a4b3ff 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -169,10 +169,6 @@ EXPORT_SYMBOL(rtc_lock);
 EXPORT_SYMBOL_GPL(set_nmi_callback);
 EXPORT_SYMBOL_GPL(unset_nmi_callback);
 
-#undef memcmp
-extern int memcmp(const void *,const void *,__kernel_size_t);
-EXPORT_SYMBOL(memcmp);
-
 EXPORT_SYMBOL(register_die_notifier);
 #ifdef CONFIG_HAVE_DEC_LOCK
 EXPORT_SYMBOL(_atomic_dec_and_lock);
diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index 671681659243..59ff9b455069 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -217,6 +217,13 @@ static void resume_execution(struct kprobe *p, struct pt_regs *regs)
                 *tos &= ~(TF_MASK | IF_MASK);
                 *tos |= kprobe_old_eflags;
                 break;
+        case 0xc3:              /* ret/lret */
+        case 0xcb:
+        case 0xc2:
+        case 0xca:
+                regs->eflags &= ~TF_MASK;
+                /* eip is already adjusted, no more changes required*/
+                return;
         case 0xe8:              /* call relative - Fix return addr */
                 *tos = orig_eip + (*tos - copy_eip);
                 break;
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index 85bd56d44314..96e3ea6b17c7 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -400,11 +400,6 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
         int err;
 
         childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
-        *childregs = *regs;
-        childregs->eax = 0;
-        childregs->esp = esp;
-
-        p->thread.esp = (unsigned long) childregs;
         /*
          * The below -8 is to reserve 8 bytes on top of the ring0 stack.
          * This is necessary to guarantee that the entire "struct pt_regs"
@@ -415,7 +410,13 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long esp,
          * "struct pt_regs" is possible, but they may contain the
          * completely wrong values.
          */
-        p->thread.esp0 = (unsigned long) (childregs+1) - 8;
+        childregs = (struct pt_regs *) ((unsigned long) childregs - 8);
+        *childregs = *regs;
+        childregs->eax = 0;
+        childregs->esp = esp;
+
+        p->thread.esp = (unsigned long) childregs;
+        p->thread.esp0 = (unsigned long) (childregs+1);
 
         p->thread.eip = (unsigned long) ret_from_fork;
 
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index cbea7ac582e5..35bfe138cb1a 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -888,6 +888,7 @@ void *xquad_portio;
 
 cpumask_t cpu_sibling_map[NR_CPUS] __cacheline_aligned;
 cpumask_t cpu_core_map[NR_CPUS] __cacheline_aligned;
+EXPORT_SYMBOL(cpu_core_map);
 
 static void __init smp_boot_cpus(unsigned int max_cpus)
 {
diff --git a/arch/i386/mm/ioremap.c b/arch/i386/mm/ioremap.c
index db06f7399913..ab542792b27b 100644
--- a/arch/i386/mm/ioremap.c
+++ b/arch/i386/mm/ioremap.c
@@ -238,19 +238,21 @@ void iounmap(volatile void __iomem *addr)
                         addr < phys_to_virt(ISA_END_ADDRESS))
                 return;
 
-        p = remove_vm_area((void *) (PAGE_MASK & (unsigned long __force) addr));
+        write_lock(&vmlist_lock);
+        p = __remove_vm_area((void *) (PAGE_MASK & (unsigned long __force) addr));
         if (!p) { 
-                printk("__iounmap: bad address %p\n", addr);
-                return;
+                printk("iounmap: bad address %p\n", addr);
+                goto out_unlock;
         }
 
         if ((p->flags >> 20) && p->phys_addr < virt_to_phys(high_memory) - 1) {
-                /* p->size includes the guard page, but cpa doesn't like that */
                 change_page_attr(virt_to_page(__va(p->phys_addr)),
                                  p->size >> PAGE_SHIFT,
                                  PAGE_KERNEL);
                 global_flush_tlb();
         } 
+out_unlock:
+        write_unlock(&vmlist_lock);
         kfree(p); 
 }
 
diff --git a/arch/i386/pci/fixup.c b/arch/i386/pci/fixup.c
index be52c5ac4e05..8e8e895e1b5a 100644
--- a/arch/i386/pci/fixup.c
+++ b/arch/i386/pci/fixup.c
@@ -253,7 +253,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE2, pci
 #define MAX_PCIEROOT    6
 static int quirk_aspm_offset[MAX_PCIEROOT << 3];
 
-#define GET_INDEX(a, b) (((a - PCI_DEVICE_ID_INTEL_MCH_PA) << 3) + b)
+#define GET_INDEX(a, b) ((((a) - PCI_DEVICE_ID_INTEL_MCH_PA) << 3) + ((b) & 7))
 
 static int quirk_pcie_aspm_read(struct pci_bus *bus, unsigned int devfn, int where, int size, u32 *value)
 {
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index ce13ad689d19..3ad2c4af099c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -46,6 +46,10 @@ config GENERIC_IOMAP
         bool
         default y
 
+config SCHED_NO_NO_OMIT_FRAME_POINTER
+        bool
+        default y
+
 choice
         prompt "System type"
         default IA64_GENERIC
diff --git a/arch/ia64/ia32/ia32_ioctl.c b/arch/ia64/ia32/ia32_ioctl.c
index 9845dabe2613..164b211f4174 100644
--- a/arch/ia64/ia32/ia32_ioctl.c
+++ b/arch/ia64/ia32/ia32_ioctl.c
@@ -13,7 +13,6 @@
   
 #define INCLUDES
 #include "compat_ioctl.c"
-#include <asm/ioctl32.h>
 
 #define IOCTL_NR(a)     ((a) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT))
 
diff --git a/arch/mips/vr41xx/common/pmu.c b/arch/mips/vr41xx/common/pmu.c
index c5f1043de938..53166f3598b2 100644
--- a/arch/mips/vr41xx/common/pmu.c
+++ b/arch/mips/vr41xx/common/pmu.c
@@ -1,7 +1,7 @@
 /*
  *  pmu.c, Power Management Unit routines for NEC VR4100 series.
  *
- *  Copyright (C) 2003-2004  Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
+ *  Copyright (C) 2003-2005  Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -17,7 +17,9 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+#include <linux/errno.h>
 #include <linux/init.h>
+#include <linux/ioport.h>
 #include <linux/kernel.h>
 #include <linux/smp.h>
 #include <linux/types.h>
@@ -27,20 +29,31 @@
 #include <asm/reboot.h>
 #include <asm/system.h>
 
-#define PMUCNT2REG      KSEG1ADDR(0x0f0000c6)
+#define PMU_TYPE1_BASE  0x0b0000a0UL
+#define PMU_TYPE1_SIZE  0x0eUL
+
+#define PMU_TYPE2_BASE  0x0f0000c0UL
+#define PMU_TYPE2_SIZE  0x10UL
+
+#define PMUCNT2REG      0x06
  #define SOFTRST        0x0010
 
+static void __iomem *pmu_base;
+
+#define pmu_read(offset)                readw(pmu_base + (offset))
+#define pmu_write(offset, value)        writew((value), pmu_base + (offset))
+
 static inline void software_reset(void)
 {
-        uint16_t val;
+        uint16_t pmucnt2;
 
         switch (current_cpu_data.cputype) {
         case CPU_VR4122:
         case CPU_VR4131:
         case CPU_VR4133:
-                val = readw(PMUCNT2REG);
-                val |= SOFTRST;
-                writew(val, PMUCNT2REG);
+                pmucnt2 = pmu_read(PMUCNT2REG);
+                pmucnt2 |= SOFTRST;
+                pmu_write(PMUCNT2REG, pmucnt2);
                 break;
         default:
                 break;
@@ -71,6 +84,34 @@ static void vr41xx_power_off(void)
 
 static int __init vr41xx_pmu_init(void)
 {
+        unsigned long start, size;
+
+        switch (current_cpu_data.cputype) {
+        case CPU_VR4111:
+        case CPU_VR4121:
+                start = PMU_TYPE1_BASE;
+                size = PMU_TYPE1_SIZE;
+                break;
+        case CPU_VR4122:
+        case CPU_VR4131:
+        case CPU_VR4133:
+                start = PMU_TYPE2_BASE;
+                size = PMU_TYPE2_SIZE;
+                break;
+        default:
+                printk("Unexpected CPU of NEC VR4100 series\n");
+                return -ENODEV;
+        }
+
+        if (request_mem_region(start, size, "PMU") == NULL)
+                return -EBUSY;
+
+        pmu_base = ioremap(start, size);
+        if (pmu_base == NULL) {
+                release_mem_region(start, size);
+                return -EBUSY;
+        }
+
         _machine_restart = vr41xx_restart;
         _machine_halt = vr41xx_halt;
         _machine_power_off = vr41xx_power_off;
@@ -78,4 +119,4 @@ static int __init vr41xx_pmu_init(void)
         return 0;
 }
 
-early_initcall(vr41xx_pmu_init);
+core_initcall(vr41xx_pmu_init);
diff --git a/arch/ppc/Kconfig b/arch/ppc/Kconfig
index ff04dcd30200..600f23d7fd33 100644
--- a/arch/ppc/Kconfig
+++ b/arch/ppc/Kconfig
@@ -43,6 +43,10 @@ config GENERIC_NVRAM
         bool
         default y
 
+config SCHED_NO_NO_OMIT_FRAME_POINTER
+        bool
+        default y
+
 source "init/Kconfig"
 
 menu "Processor"
@@ -73,9 +77,11 @@ config 44x
         bool "44x"
 
 config POWER3
+        select PPC_FPU
         bool "POWER3"
 
 config POWER4
+        select PPC_FPU
         bool "POWER4 and 970 (G5)"
 
 config 8xx
diff --git a/arch/ppc/kernel/head_44x.S b/arch/ppc/kernel/head_44x.S
index 9b6a8e513657..6c7ae6052464 100644
--- a/arch/ppc/kernel/head_44x.S
+++ b/arch/ppc/kernel/head_44x.S
@@ -330,8 +330,9 @@ interrupt_base:
         /* If we are faulting a kernel address, we have to use the
          * kernel page tables.
          */
-        andis.  r11, r10, 0x8000
-        beq     3f
+        lis     r11, TASK_SIZE@h
+        cmplw   r10, r11
+        blt+    3f
         lis     r11, swapper_pg_dir@h
         ori     r11, r11, swapper_pg_dir@l
 
@@ -464,8 +465,9 @@ interrupt_base:
         /* If we are faulting a kernel address, we have to use the
          * kernel page tables.
          */
-        andis.  r11, r10, 0x8000
-        beq     3f
+        lis     r11, TASK_SIZE@h
+        cmplw   r10, r11
+        blt+    3f
         lis     r11, swapper_pg_dir@h
         ori     r11, r11, swapper_pg_dir@l
 
@@ -533,8 +535,9 @@ interrupt_base:
         /* If we are faulting a kernel address, we have to use the
          * kernel page tables.
          */
-        andis.  r11, r10, 0x8000
-        beq     3f
+        lis     r11, TASK_SIZE@h
+        cmplw   r10, r11
+        blt+    3f
         lis     r11, swapper_pg_dir@h
         ori     r11, r11, swapper_pg_dir@l
 
diff --git a/arch/ppc/kernel/setup.c b/arch/ppc/kernel/setup.c
index e97ce635b99e..5c20266e3b1f 100644
--- a/arch/ppc/kernel/setup.c
+++ b/arch/ppc/kernel/setup.c
@@ -221,27 +221,26 @@ int show_cpuinfo(struct seq_file *m, void *v)
                         return err;
         }
 
-        switch (PVR_VER(pvr)) {
-        case 0x0020:    /* 403 family */
-                maj = PVR_MAJ(pvr) + 1;
-                min = PVR_MIN(pvr);
-                break;
-        case 0x1008:    /* 740P/750P ?? */
-                maj = ((pvr >> 8) & 0xFF) - 1;
-                min = pvr & 0xFF;
-                break;
-        case 0x8083:    /* e300 */
-                maj = PVR_MAJ(pvr);
-                min = PVR_MIN(pvr);
-                break;
-        case 0x8020:    /* e500 */
+        /* If we are a Freescale core do a simple check so
+         * we dont have to keep adding cases in the future */
+        if ((PVR_VER(pvr) & 0x8000) == 0x8000) {
                 maj = PVR_MAJ(pvr);
                 min = PVR_MIN(pvr);
-                break;
-        default:
-                maj = (pvr >> 8) & 0xFF;
-                min = pvr & 0xFF;
-                break;
+        } else {
+                switch (PVR_VER(pvr)) {
+                        case 0x0020:    /* 403 family */
+                                maj = PVR_MAJ(pvr) + 1;
+                                min = PVR_MIN(pvr);
+                                break;
+                        case 0x1008:    /* 740P/750P ?? */
+                                maj = ((pvr >> 8) & 0xFF) - 1;
+                                min = pvr & 0xFF;
+                                break;
+                        default:
+                                maj = (pvr >> 8) & 0xFF;
+                                min = pvr & 0xFF;
+                                break;
+                }
         }
 
         seq_printf(m, "revision\t: %hd.%hd (pvr %04x %04x)\n",
@@ -500,7 +499,7 @@ static int __init set_preferred_console(void)
 {
         struct device_node *prom_stdout;
         char *name;
-        int offset;
+        int offset = 0;
 
         if (of_stdout_device == NULL)
                 return -ENODEV;
@@ -754,6 +753,8 @@ void __init setup_arch(char **cmdline_p)
         strlcpy(saved_command_line, cmd_line, COMMAND_LINE_SIZE);
         *cmdline_p = cmd_line;
 
+        parse_early_param();
+
         /* set up the bootmem stuff with available memory */
         do_init_bootmem();
         if ( ppc_md.progress ) ppc_md.progress("setup_arch: bootmem", 0x3eab);
diff --git a/arch/ppc/kernel/vmlinux.lds.S b/arch/ppc/kernel/vmlinux.lds.S
index 0c0e714b84de..9353584fb710 100644
--- a/arch/ppc/kernel/vmlinux.lds.S
+++ b/arch/ppc/kernel/vmlinux.lds.S
@@ -145,6 +145,7 @@ SECTIONS
   __init_end = .;
 
   . = ALIGN(4096);
+  _sextratext = .;
   __pmac_begin = .;
   .pmac.text : { *(.pmac.text) }
   .pmac.data : { *(.pmac.data) }
@@ -171,6 +172,7 @@ SECTIONS
   .openfirmware.data : { *(.openfirmware.data) }
   . = ALIGN(4096);
   __openfirmware_end = .;
+  _eextratext = .;
 
   __bss_start = .;
   .bss       :
diff --git a/arch/ppc/lib/string.S b/arch/ppc/lib/string.S
index 8d08a2eb225e..36c9b97fd92a 100644
--- a/arch/ppc/lib/string.S
+++ b/arch/ppc/lib/string.S
@@ -446,6 +446,7 @@ _GLOBAL(__copy_tofrom_user)
 #ifdef CONFIG_8xx
         /* Don't use prefetch on 8xx */
         mtctr   r0
+        li      r0,0
 53:     COPY_16_BYTES_WITHEX(0)
         bdnz    53b
 
@@ -564,7 +565,9 @@ _GLOBAL(__copy_tofrom_user)
 /* or write fault in cacheline loop */
 105:    li      r9,1
 92:     li      r3,LG_CACHELINE_BYTES
-        b       99f
+        mfctr   r8
+        add     r0,r0,r8
+        b       106f
 /* read fault in final word loop */
 108:    li      r9,0
         b       93f
@@ -585,7 +588,7 @@ _GLOBAL(__copy_tofrom_user)
  * r5 + (ctr << r3), and r9 is 0 for read or 1 for write.
  */
 99:     mfctr   r0
-        slw     r3,r0,r3
+106:    slw     r3,r0,r3
         add.    r3,r3,r5
         beq     120f                    /* shouldn't happen */
         cmpwi   0,r9,0
diff --git a/arch/ppc/mm/init.c b/arch/ppc/mm/init.c
index be02a7fec2b7..363c157e3617 100644
--- a/arch/ppc/mm/init.c
+++ b/arch/ppc/mm/init.c
@@ -179,6 +179,7 @@ void free_initmem(void)
         if (!have_of)
                 FREESEC(openfirmware);
         printk("\n");
+        ppc_md.progress = NULL;
 #undef FREESEC
 }
 
diff --git a/arch/ppc/syslib/mpc83xx_devices.c b/arch/ppc/syslib/mpc83xx_devices.c
index 5c1a919eaabf..75c8e9834ae7 100644
--- a/arch/ppc/syslib/mpc83xx_devices.c
+++ b/arch/ppc/syslib/mpc83xx_devices.c
@@ -61,6 +61,7 @@ static struct plat_serial8250_port serial_platform_data[] = {
                 .iotype         = UPIO_MEM,
                 .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST,
         },
+        { },
 };
 
 struct platform_device ppc_sys_platform_devices[] = {
diff --git a/arch/ppc/syslib/mpc85xx_devices.c b/arch/ppc/syslib/mpc85xx_devices.c
index a231795ee26f..1e658ef57e75 100644
--- a/arch/ppc/syslib/mpc85xx_devices.c
+++ b/arch/ppc/syslib/mpc85xx_devices.c
@@ -61,6 +61,7 @@ static struct plat_serial8250_port serial_platform_data[] = {
                 .iotype         = UPIO_MEM,
                 .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_SHARE_IRQ,
         },
+        { },
 };
 
 struct platform_device ppc_sys_platform_devices[] = {
diff --git a/arch/ppc/syslib/open_pic.c b/arch/ppc/syslib/open_pic.c
index 7619e16fccae..9d4ed68b5804 100644
--- a/arch/ppc/syslib/open_pic.c
+++ b/arch/ppc/syslib/open_pic.c
@@ -557,12 +557,10 @@ static void __init openpic_initipi(u_int ipi, u_int pri, u_int vec)
  */
 void openpic_cause_IPI(u_int ipi, cpumask_t cpumask)
 {
-        cpumask_t phys;
         DECL_THIS_CPU;
 
         CHECK_THIS_CPU;
         check_arg_ipi(ipi);
-        phys = physmask(cpumask);
         openpic_write(&OpenPIC->THIS_CPU.IPI_Dispatch(ipi),
                       cpus_addr(physmask(cpumask))[0]);
 }
diff --git a/arch/ppc64/Kconfig b/arch/ppc64/Kconfig
index f5508abf1188..5cb343883e4d 100644
--- a/arch/ppc64/Kconfig
+++ b/arch/ppc64/Kconfig
@@ -40,6 +40,10 @@ config COMPAT
         bool
         default y
 
+config SCHED_NO_NO_OMIT_FRAME_POINTER
+        bool
+        default y
+
 # We optimistically allocate largepages from the VM, so make the limit
 # large enough (16MB). This badly named config option is actually
 # max order + 1
@@ -258,6 +262,7 @@ config PPC_RTAS
 config RTAS_PROC
         bool "Proc interface to RTAS"
         depends on PPC_RTAS
+        default y
 
 config RTAS_FLASH
         tristate "Firmware flash interface"
diff --git a/arch/ppc64/Kconfig.debug b/arch/ppc64/Kconfig.debug
index e341a129da80..46b1ce58da3b 100644
--- a/arch/ppc64/Kconfig.debug
+++ b/arch/ppc64/Kconfig.debug
@@ -5,6 +5,9 @@ source "lib/Kconfig.debug"
 config DEBUG_STACKOVERFLOW
         bool "Check for stack overflows"
         depends on DEBUG_KERNEL
+        help
+          This option will cause messages to be printed if free stack space
+          drops below a certain limit.
 
 config KPROBES
         bool "Kprobes"
diff --git a/arch/ppc64/boot/main.c b/arch/ppc64/boot/main.c
index b0fa86ad8b1b..da12ea2ca464 100644
--- a/arch/ppc64/boot/main.c
+++ b/arch/ppc64/boot/main.c
@@ -14,7 +14,6 @@
 #include <linux/string.h>
 #include <asm/processor.h>
 #include <asm/page.h>
-#include <asm/bootinfo.h>
 
 extern void *finddevice(const char *);
 extern int getprop(void *, const char *, void *, int);
diff --git a/arch/ppc64/boot/start.c b/arch/ppc64/boot/start.c
deleted file mode 100644
index ea247e79b55e..000000000000
--- a/arch/ppc64/boot/start.c
+++ /dev/null
@@ -1,654 +0,0 @@
-/*
- * Copyright (C) Paul Mackerras 1997.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-#include <stdarg.h>
-#include <linux/types.h>
-#include <linux/string.h>
-#include <linux/ctype.h>
-
-#include <asm/div64.h>
-
-int (*prom)(void *);
-
-void *chosen_handle;
-void *stdin;
-void *stdout;
-void *stderr;
-
-void exit(void);
-void *finddevice(const char *name);
-int getprop(void *phandle, const char *name, void *buf, int buflen);
-void chrpboot(int a1, int a2, void *prom);      /* in main.c */
-
-void printk(char *fmt, ...);
-
-void
-start(int a1, int a2, void *promptr)
-{
-        prom = (int (*)(void *)) promptr;
-        chosen_handle = finddevice("/chosen");
-        if (chosen_handle == (void *) -1)
-                exit();
-        if (getprop(chosen_handle, "stdout", &stdout, sizeof(stdout)) != 4)
-                exit();
-        stderr = stdout;
-        if (getprop(chosen_handle, "stdin", &stdin, sizeof(stdin)) != 4)
-        exit();
-
-        chrpboot(a1, a2, promptr);
-        for (;;)
-                exit();
-}
-
-int
-write(void *handle, void *ptr, int nb)
-{
-        struct prom_args {
-                char *service;
-                int nargs;
-                int nret;
-                void *ihandle;
-                void *addr;
-                int len;
-                int actual;
-        } args;
-
-        args.service = "write";
-        args.nargs = 3;
-        args.nret = 1;
-        args.ihandle = handle;
-        args.addr = ptr;
-        args.len = nb;
-        args.actual = -1;
-        (*prom)(&args);
-        return args.actual;
-}
-
-int
-read(void *handle, void *ptr, int nb)
-{
-        struct prom_args {
-                char *service;
-                int nargs;
-                int nret;
-                void *ihandle;
-                void *addr;
-                int len;
-                int actual;
-        } args;
-
-        args.service = "read";
-        args.nargs = 3;
-        args.nret = 1;
-        args.ihandle = handle;
-        args.addr = ptr;
-        args.len = nb;
-        args.actual = -1;
-        (*prom)(&args);
-        return args.actual;
-}
-
-void
-exit()
-{
-        struct prom_args {
-                char *service;
-        } args;
-
-        for (;;) {
-                args.service = "exit";
-                (*prom)(&args);
-        }
-}
-
-void
-pause(void)
-{
-        struct prom_args {
-                char *service;
-        } args;
-
-        args.service = "enter";
-        (*prom)(&args);
-}
-
-void *
-finddevice(const char *name)
-{
-        struct prom_args {
-                char *service;
-                int nargs;
-                int nret;
-                const char *devspec;
-                void *phandle;
-        } args;
-
-        args.service = "finddevice";
-        args.nargs = 1;
-        args.nret = 1;
-        args.devspec = name;
-        args.phandle = (void *) -1;
-        (*prom)(&args);
-        return args.phandle;
-}
-
-void *
-claim(unsigned long virt, unsigned long size, unsigned long align)
-{
-        struct prom_args {
-                char *service;
-                int nargs;
-                int nret;
-                unsigned int virt;
-                unsigned int size;
-                unsigned int align;
-                void *ret;
-        } args;
-
-        args.service = "claim";
-        args.nargs = 3;
-        args.nret = 1;
-        args.virt = virt;
-        args.size = size;
-        args.align = align;
-        (*prom)(&args);
-        return args.ret;
-}
-
-int
-getprop(void *phandle, const char *name, void *buf, int buflen)
-{
-        struct prom_args {
-                char *service;
-                int nargs;
-                int nret;
-                void *phandle;
-                const char *name;
-                void *buf;
-                int buflen;
-                int size;
-        } args;
-
-        args.service = "getprop";
-        args.nargs = 4;
-        args.nret = 1;
-        args.phandle = phandle;
-        args.name = name;
-        args.buf = buf;
-        args.buflen = buflen;
-        args.size = -1;
-        (*prom)(&args);
-        return args.size;
-}
-
-int
-putc(int c, void *f)
-{
-        char ch = c;
-
-        if (c == '\n')
-                putc('\r', f);
-        return write(f, &ch, 1) == 1? c: -1;
-}
-
-int
-putchar(int c)
-{
-        return putc(c, stdout);
-}
-
-int
-fputs(char *str, void *f)
-{
-        int n = strlen(str);
-
-        return write(f, str, n) == n? 0: -1;
-}
-
-int
-readchar(void)
-{
-        char ch;
-
-        for (;;) {
-                switch (read(stdin, &ch, 1)) {
-                case 1:
-                        return ch;
-                case -1:
-                        printk("read(stdin) returned -1\r\n");
-                        return -1;
-                }
-        }
-}
-
-static char line[256];
-static char *lineptr;
-static int lineleft;
-
-int
-getchar(void)
-{
-        int c;
-
-        if (lineleft == 0) {
-                lineptr = line;
-                for (;;) {
-                        c = readchar();
-                        if (c == -1 || c == 4)
-                                break;
-                        if (c == '\r' || c == '\n') {
-                                *lineptr++ = '\n';
-                                putchar('\n');
-                                break;
-                        }
-                        switch (c) {
-                        case 0177:
-                        case '\b':
-                                if (lineptr > line) {
-                                        putchar('\b');
-                                        putchar(' ');
-                                        putchar('\b');
-                                        --lineptr;
-                                }
-                                break;
-                        case 'U' & 0x1F:
-                                while (lineptr > line) {
-                                        putchar('\b');
-                                        putchar(' ');
-                                        putchar('\b');
-                                        --lineptr;
-                                }
-                                break;
-                        default:
-                                if (lineptr >= &line[sizeof(line) - 1])
-                                        putchar('\a');
-                                else {
-                                        putchar(c);
-                                        *lineptr++ = c;
-                                }
-                        }
-                }
-                lineleft = lineptr - line;
-                lineptr = line;
-        }
-        if (lineleft == 0)
-                return -1;
-        --lineleft;
-        return *lineptr++;
-}
-
-
-
-/* String functions lifted from lib/vsprintf.c and lib/ctype.c */
-unsigned char _ctype[] = {
-_C,_C,_C,_C,_C,_C,_C,_C,                        /* 0-7 */
-_C,_C|_S,_C|_S,_C|_S,_C|_S,_C|_S,_C,_C,         /* 8-15 */
-_C,_C,_C,_C,_C,_C,_C,_C,                        /* 16-23 */
-_C,_C,_C,_C,_C,_C,_C,_C,                        /* 24-31 */
-_S|_SP,_P,_P,_P,_P,_P,_P,_P,                    /* 32-39 */
-_P,_P,_P,_P,_P,_P,_P,_P,                        /* 40-47 */
-_D,_D,_D,_D,_D,_D,_D,_D,                        /* 48-55 */
-_D,_D,_P,_P,_P,_P,_P,_P,                        /* 56-63 */
-_P,_U|_X,_U|_X,_U|_X,_U|_X,_U|_X,_U|_X,_U,      /* 64-71 */
-_U,_U,_U,_U,_U,_U,_U,_U,                        /* 72-79 */
-_U,_U,_U,_U,_U,_U,_U,_U,                        /* 80-87 */
-_U,_U,_U,_P,_P,_P,_P,_P,                        /* 88-95 */
-_P,_L|_X,_L|_X,_L|_X,_L|_X,_L|_X,_L|_X,_L,      /* 96-103 */
-_L,_L,_L,_L,_L,_L,_L,_L,                        /* 104-111 */
-_L,_L,_L,_L,_L,_L,_L,_L,                        /* 112-119 */
-_L,_L,_L,_P,_P,_P,_P,_C,                        /* 120-127 */
-0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,                /* 128-143 */
-0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,                /* 144-159 */
-_S|_SP,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,   /* 160-175 */
-_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,_P,       /* 176-191 */
-_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,_U,       /* 192-207 */
-_U,_U,_U,_U,_U,_U,_U,_P,_U,_U,_U,_U,_U,_U,_U,_L,       /* 208-223 */
-_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,_L,       /* 224-239 */
-_L,_L,_L,_L,_L,_L,_L,_P,_L,_L,_L,_L,_L,_L,_L,_L};      /* 240-255 */
-
-size_t strnlen(const char * s, size_t count)
-{
-        const char *sc;
-
-        for (sc = s; count-- && *sc != '\0'; ++sc)
-                /* nothing */;
-        return sc - s;
-}
-
-unsigned long simple_strtoul(const char *cp,char **endp,unsigned int base)
-{
-        unsigned long result = 0,value;
-
-        if (!base) {
-                base = 10;
-                if (*cp == '0') {
-                        base = 8;
-                        cp++;
-                        if ((*cp == 'x') && isxdigit(cp[1])) {
-                                cp++;
-                                base = 16;
-                        }
-                }
-        }
-        while (isxdigit(*cp) &&
-               (value = isdigit(*cp) ? *cp-'0' : toupper(*cp)-'A'+10) < base) {
-                result = result*base + value;
-                cp++;
-        }
-        if (endp)
-                *endp = (char *)cp;
-        return result;
-}
-
-long simple_strtol(const char *cp,char **endp,unsigned int base)
-{
-        if(*cp=='-')
-                return -simple_strtoul(cp+1,endp,base);
-        return simple_strtoul(cp,endp,base);
-}
-
-static int skip_atoi(const char **s)
-{
-        int i=0;
-
-        while (isdigit(**s))
-                i = i*10 + *((*s)++) - '0';
-        return i;
-}
-
-#define ZEROPAD 1               /* pad with zero */
-#define SIGN    2               /* unsigned/signed long */
-#define PLUS    4               /* show plus */
-#define SPACE   8               /* space if plus */
-#define LEFT    16              /* left justified */
-#define SPECIAL 32              /* 0x */
-#define LARGE   64              /* use 'ABCDEF' instead of 'abcdef' */
-
-static char * number(char * str, long long num, int base, int size, int precision, int type)
-{
-        char c,sign,tmp[66];
-        const char *digits="0123456789abcdefghijklmnopqrstuvwxyz";
-        int i;
-
-        if (type & LARGE)
-                digits = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
-        if (type & LEFT)
-                type &= ~ZEROPAD;
-        if (base < 2 || base > 36)
-                return 0;
-        c = (type & ZEROPAD) ? '0' : ' ';
-        sign = 0;
-        if (type & SIGN) {
-                if (num < 0) {
-                        sign = '-';
-                        num = -num;
-                        size--;
-                } else if (type & PLUS) {
-                        sign = '+';
-                        size--;
-                } else if (type & SPACE) {
-                        sign = ' ';
-                        size--;
-                }
-        }
-        if (type & SPECIAL) {
-                if (base == 16)
-                        size -= 2;
-                else if (base == 8)
-                        size--;
-        }
-        i = 0;
-        if (num == 0)
-                tmp[i++]='0';
-        else while (num != 0)
-                tmp[i++] = digits[do_div(num,base)];
-        if (i > precision)
-                precision = i;
-        size -= precision;
-        if (!(type&(ZEROPAD+LEFT)))
-                while(size-->0)
-                        *str++ = ' ';
-        if (sign)
-                *str++ = sign;
-        if (type & SPECIAL) {
-                if (base==8)
-                        *str++ = '0';
-                else if (base==16) {
-                        *str++ = '0';
-                        *str++ = digits[33];
-                }
-        }
-        if (!(type & LEFT))
-                while (size-- > 0)
-                        *str++ = c;
-        while (i < precision--)
-                *str++ = '0';
-        while (i-- > 0)
-                *str++ = tmp[i];
-        while (size-- > 0)
-                *str++ = ' ';
-        return str;
-}
-
-/* Forward decl. needed for IP address printing stuff... */
-int sprintf(char * buf, const char *fmt, ...);
-
-int vsprintf(char *buf, const char *fmt, va_list args)
-{
-        int len;
-        unsigned long long num;
-        int i, base;
-        char * str;
-        const char *s;
-
-        int flags;              /* flags to number() */
-
-        int field_width;        /* width of output field */
-        int precision;          /* min. # of digits for integers; max
-                                   number of chars for from string */
-        int qualifier;          /* 'h', 'l', or 'L' for integer fields */
-                                /* 'z' support added 23/7/1999 S.H.    */
-                                /* 'z' changed to 'Z' --davidm 1/25/99 */
-
-        
-        for (str=buf ; *fmt ; ++fmt) {
-                if (*fmt != '%') {
-                        *str++ = *fmt;
-                        continue;
-                }
-                        
-                /* process flags */
-                flags = 0;
-                repeat:
-                        ++fmt;          /* this also skips first '%' */
-                        switch (*fmt) {
-                                case '-': flags |= LEFT; goto repeat;
-                                case '+': flags |= PLUS; goto repeat;
-                                case ' ': flags |= SPACE; goto repeat;
-                                case '#': flags |= SPECIAL; goto repeat;
-                                case '0': flags |= ZEROPAD; goto repeat;
-                                }
-                
-                /* get field width */
-                field_width = -1;
-                if (isdigit(*fmt))
-                        field_width = skip_atoi(&fmt);
-                else if (*fmt == '*') {
-                        ++fmt;
-                        /* it's the next argument */
-                        field_width = va_arg(args, int);
-                        if (field_width < 0) {
-                                field_width = -field_width;
-                                flags |= LEFT;
-                        }
-                }
-
-                /* get the precision */
-                precision = -1;
-                if (*fmt == '.') {
-                        ++fmt;  
-                        if (isdigit(*fmt))
-                                precision = skip_atoi(&fmt);
-                        else if (*fmt == '*') {
-                                ++fmt;
-                                /* it's the next argument */
-                                precision = va_arg(args, int);
-                        }
-                        if (precision < 0)
-                                precision = 0;
-                }
-
-                /* get the conversion qualifier */
-                qualifier = -1;
-                if (*fmt == 'h' || *fmt == 'l' || *fmt == 'L' || *fmt =='Z') {
-                        qualifier = *fmt;
-                        ++fmt;
-                }
-
-                /* default base */
-                base = 10;
-
-                switch (*fmt) {
-                case 'c':
-                        if (!(flags & LEFT))
-                                while (--field_width > 0)
-                                        *str++ = ' ';
-                        *str++ = (unsigned char) va_arg(args, int);
-                        while (--field_width > 0)
-                                *str++ = ' ';
-                        continue;
-
-                case 's':
-                        s = va_arg(args, char *);
-                        if (!s)
-                                s = "<NULL>";
-
-                        len = strnlen(s, precision);
-
-                        if (!(flags & LEFT))
-                                while (len < field_width--)
-                                        *str++ = ' ';
-                        for (i = 0; i < len; ++i)
-                                *str++ = *s++;
-                        while (len < field_width--)
-                                *str++ = ' ';
-                        continue;
-
-                case 'p':
-                        if (field_width == -1) {
-                                field_width = 2*sizeof(void *);
-                                flags |= ZEROPAD;
-                        }
-                        str = number(str,
-                                (unsigned long) va_arg(args, void *), 16,
-                                field_width, precision, flags);
-                        continue;
-
-
-                case 'n':
-                        if (qualifier == 'l') {
-                                long * ip = va_arg(args, long *);
-                                *ip = (str - buf);
-                        } else if (qualifier == 'Z') {
-                                size_t * ip = va_arg(args, size_t *);
-                                *ip = (str - buf);
-                        } else {
-                                int * ip = va_arg(args, int *);
-                                *ip = (str - buf);
-                        }
-                        continue;
-
-                case '%':
-                        *str++ = '%';
-                        continue;
-
-                /* integer number formats - set up the flags and "break" */
-                case 'o':
-                        base = 8;
-                        break;
-
-                case 'X':
-                        flags |= LARGE;
-                case 'x':
-                        base = 16;
-                        break;
-
-                case 'd':
-                case 'i':
-                        flags |= SIGN;
-                case 'u':
-                        break;
-
-                default:
-                        *str++ = '%';
-                        if (*fmt)
-                                *str++ = *fmt;
-                        else
-                                --fmt;
-                        continue;
-                }
-                if (qualifier == 'L')
-                        num = va_arg(args, long long);
-                else if (qualifier == 'l') {
-                        num = va_arg(args, unsigned long);
-                        if (flags & SIGN)
-                                num = (signed long) num;
-                } else if (qualifier == 'Z') {
-                        num = va_arg(args, size_t);
-                } else if (qualifier == 'h') {
-                        num = (unsigned short) va_arg(args, int);
-                        if (flags & SIGN)
-                                num = (signed short) num;
-                } else {
-                        num = va_arg(args, unsigned int);
-                        if (flags & SIGN)
-                                num = (signed int) num;
-                }
-                str = number(str, num, base, field_width, precision, flags);
-        }
-        *str = '\0';
-        return str-buf;
-}
-
-int sprintf(char * buf, const char *fmt, ...)
-{
-        va_list args;
-        int i;
-
-        va_start(args, fmt);
-        i=vsprintf(buf,fmt,args);
-        va_end(args);
-        return i;
-}
-
-static char sprint_buf[1024];
-
-void
-printk(char *fmt, ...)
-{
-        va_list args;
-        int n;
-
-        va_start(args, fmt);
-        n = vsprintf(sprint_buf, fmt, args);
-        va_end(args);
-        write(stdout, sprint_buf, n);
-}
-
-int
-printf(char *fmt, ...)
-{
-        va_list args;
-        int n;
-
-        va_start(args, fmt);
-        n = vsprintf(sprint_buf, fmt, args);
-        va_end(args);
-        write(stdout, sprint_buf, n);
-        return n;
-}
diff --git a/arch/ppc64/kernel/misc.S b/arch/ppc64/kernel/misc.S
index 90b41f48d21c..b944717c1dbd 100644
--- a/arch/ppc64/kernel/misc.S
+++ b/arch/ppc64/kernel/misc.S
@@ -32,7 +32,7 @@
         .text
 
 /*
- * Returns (address we're running at) - (address we were linked at)
+ * Returns (address we were linked at) - (address we are running at)
  * for use before the text and data are mapped to KERNELBASE.
  */
 
diff --git a/arch/ppc64/kernel/pSeries_smp.c b/arch/ppc64/kernel/pSeries_smp.c
index c60d8cb2b84d..fbad349ec58c 100644
--- a/arch/ppc64/kernel/pSeries_smp.c
+++ b/arch/ppc64/kernel/pSeries_smp.c
@@ -326,13 +326,6 @@ static void __devinit smp_xics_setup_cpu(int cpu)
 
         cpu_clear(cpu, of_spin_map);
 
-        /*
-         * Put the calling processor into the GIQ.  This is really only
-         * necessary from a secondary thread as the OF start-cpu interface
-         * performs this function for us on primary threads.
-         */
-        rtas_set_indicator(GLOBAL_INTERRUPT_QUEUE,
-                (1UL << interrupt_server_size) - 1 - default_distrib_server, 1);
 }
 
 static DEFINE_SPINLOCK(timebase_lock);
diff --git a/arch/ppc64/kernel/pci.c b/arch/ppc64/kernel/pci.c
index be3cc387c1ec..d786d4b6af0b 100644
--- a/arch/ppc64/kernel/pci.c
+++ b/arch/ppc64/kernel/pci.c
@@ -438,7 +438,7 @@ pgprot_t pci_phys_mem_access_prot(struct file *file,
         int i;
 
         if (page_is_ram(offset >> PAGE_SHIFT))
-                return prot;
+                return __pgprot(prot);
 
         prot |= _PAGE_NO_CACHE | _PAGE_GUARDED;
 
diff --git a/arch/ppc64/kernel/prom.c b/arch/ppc64/kernel/prom.c
index fe2946c58314..eb6538b58008 100644
--- a/arch/ppc64/kernel/prom.c
+++ b/arch/ppc64/kernel/prom.c
@@ -834,7 +834,7 @@ void __init unflatten_device_tree(void)
 {
         unsigned long start, mem, size;
         struct device_node **allnextp = &allnodes;
-        char *p;
+        char *p = NULL;
         int l = 0;
 
         DBG(" -> unflatten_device_tree()\n");
diff --git a/arch/ppc64/kernel/signal.c b/arch/ppc64/kernel/signal.c
index a95a2b49a1d5..bf782276984c 100644
--- a/arch/ppc64/kernel/signal.c
+++ b/arch/ppc64/kernel/signal.c
@@ -42,11 +42,7 @@
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
-#ifndef MIN
-#define MIN(a,b) (((a) < (b)) ? (a) : (b))
-#endif
-
-#define GP_REGS_SIZE    MIN(sizeof(elf_gregset_t), sizeof(struct pt_regs))
+#define GP_REGS_SIZE    min(sizeof(elf_gregset_t), sizeof(struct pt_regs))
 #define FP_REGS_SIZE    sizeof(elf_fpregset_t)
 
 #define TRAMP_TRACEBACK 3
diff --git a/arch/ppc64/kernel/xics.c b/arch/ppc64/kernel/xics.c
index eedd1d3c2a10..879f39b90a33 100644
--- a/arch/ppc64/kernel/xics.c
+++ b/arch/ppc64/kernel/xics.c
@@ -432,6 +432,7 @@ void xics_cause_IPI(int cpu)
 {
         ops->qirr_info(cpu, IPI_PRIORITY);
 }
+#endif /* CONFIG_SMP */
 
 void xics_setup_cpu(void)
 {
@@ -439,9 +440,17 @@ void xics_setup_cpu(void)
 
         ops->cppr_info(cpu, 0xff);
         iosync();
-}
 
-#endif /* CONFIG_SMP */
+        /*
+         * Put the calling processor into the GIQ.  This is really only
+         * necessary from a secondary thread as the OF start-cpu interface
+         * performs this function for us on primary threads.
+         *
+         * XXX: undo of teardown on kexec needs this too, as may hotplug
+         */
+        rtas_set_indicator(GLOBAL_INTERRUPT_QUEUE,
+                (1UL << interrupt_server_size) - 1 - default_distrib_server, 1);
+}
 
 void xics_init_IRQ(void)
 {
@@ -563,8 +572,7 @@ nextnode:
         for (; i < NR_IRQS; ++i)
                 get_irq_desc(i)->handler = &xics_pic;
 
-        ops->cppr_info(boot_cpuid, 0xff);
-        iosync();
+        xics_setup_cpu();
 
         ppc64_boot_msg(0x21, "XICS Done");
 }
diff --git a/arch/ppc64/mm/hash_native.c b/arch/ppc64/mm/hash_native.c
index 144657e0c3d5..52b6b9305341 100644
--- a/arch/ppc64/mm/hash_native.c
+++ b/arch/ppc64/mm/hash_native.c
@@ -320,8 +320,7 @@ static void native_flush_hash_range(unsigned long context,
 
         j = 0;
         for (i = 0; i < number; i++) {
-                if ((batch->addr[i] >= USER_START) &&
-                    (batch->addr[i] <= USER_END))
+                if (batch->addr[i] < KERNELBASE)
                         vsid = get_vsid(context, batch->addr[i]);
                 else
                         vsid = get_kernel_vsid(batch->addr[i]);
diff --git a/arch/ppc64/mm/hash_utils.c b/arch/ppc64/mm/hash_utils.c
index e48be12f518c..0a0f97008d02 100644
--- a/arch/ppc64/mm/hash_utils.c
+++ b/arch/ppc64/mm/hash_utils.c
@@ -298,24 +298,23 @@ int hash_page(unsigned long ea, unsigned long access, unsigned long trap)
         int local = 0;
         cpumask_t tmp;
 
+        if ((ea & ~REGION_MASK) > EADDR_MASK)
+                return 1;
+
         switch (REGION_ID(ea)) {
         case USER_REGION_ID:
                 user_region = 1;
                 mm = current->mm;
-                if ((ea > USER_END) || (! mm))
+                if (! mm)
                         return 1;
 
                 vsid = get_vsid(mm->context.id, ea);
                 break;
         case IO_REGION_ID:
-                if (ea > IMALLOC_END)
-                        return 1;
                 mm = &ioremap_mm;
                 vsid = get_kernel_vsid(ea);
                 break;
         case VMALLOC_REGION_ID:
-                if (ea > VMALLOC_END)
-                        return 1;
                 mm = &init_mm;
                 vsid = get_kernel_vsid(ea);
                 break;
@@ -362,7 +361,7 @@ void flush_hash_page(unsigned long context, unsigned long ea, pte_t pte,
         unsigned long vsid, vpn, va, hash, secondary, slot;
         unsigned long huge = pte_huge(pte);
 
-        if ((ea >= USER_START) && (ea <= USER_END))
+        if (ea < KERNELBASE)
                 vsid = get_vsid(context, ea);
         else
                 vsid = get_kernel_vsid(ea);
diff --git a/arch/ppc64/mm/imalloc.c b/arch/ppc64/mm/imalloc.c
index 9d92b0d9cde5..cb8727f3267a 100644
--- a/arch/ppc64/mm/imalloc.c
+++ b/arch/ppc64/mm/imalloc.c
@@ -14,6 +14,7 @@
 #include <asm/pgalloc.h>
 #include <asm/pgtable.h>
 #include <asm/semaphore.h>
+#include <asm/imalloc.h>
 
 static DECLARE_MUTEX(imlist_sem);
 struct vm_struct * imlist = NULL;
@@ -23,11 +24,11 @@ static int get_free_im_addr(unsigned long size, unsigned long *im_addr)
         unsigned long addr;
         struct vm_struct **p, *tmp;
 
-        addr = IMALLOC_START;
+        addr = ioremap_bot;
         for (p = &imlist; (tmp = *p) ; p = &tmp->next) {
                 if (size + addr < (unsigned long) tmp->addr)
                         break;
-                if ((unsigned long)tmp->addr >= IMALLOC_START) 
+                if ((unsigned long)tmp->addr >= ioremap_bot)
                         addr = tmp->size + (unsigned long) tmp->addr;
                 if (addr > IMALLOC_END-size) 
                         return 1;
diff --git a/arch/ppc64/mm/init.c b/arch/ppc64/mm/init.c
index cf33d7ec2e29..4b42aff74d73 100644
--- a/arch/ppc64/mm/init.c
+++ b/arch/ppc64/mm/init.c
@@ -64,6 +64,7 @@
 #include <asm/iommu.h>
 #include <asm/abs_addr.h>
 #include <asm/vdso.h>
+#include <asm/imalloc.h>
 
 int mem_init_done;
 unsigned long ioremap_bot = IMALLOC_BASE;
@@ -668,7 +669,7 @@ void __init paging_init(void)
         zones_size[ZONE_DMA] = top_of_ram >> PAGE_SHIFT;
         zholes_size[ZONE_DMA] = (top_of_ram - total_ram) >> PAGE_SHIFT;
 
-        free_area_init_node(0, &contig_page_data, zones_size,
+        free_area_init_node(0, NODE_DATA(0), zones_size,
                             __pa(PAGE_OFFSET) >> PAGE_SHIFT, zholes_size);
 }
 #endif /* CONFIG_DISCONTIGMEM */
diff --git a/arch/ppc64/mm/stab.c b/arch/ppc64/mm/stab.c
index 31491131d5e4..df4bbe14153c 100644
--- a/arch/ppc64/mm/stab.c
+++ b/arch/ppc64/mm/stab.c
@@ -19,6 +19,11 @@
 #include <asm/paca.h>
 #include <asm/cputable.h>
 
+struct stab_entry {
+        unsigned long esid_data;
+        unsigned long vsid_data;
+};
+
 /* Both the segment table and SLB code uses the following cache */
 #define NR_STAB_CACHE_ENTRIES 8
 DEFINE_PER_CPU(long, stab_cache_ptr);
diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
index 066e253f9c12..2c216ffeea90 100644
--- a/arch/sparc/kernel/process.c
+++ b/arch/sparc/kernel/process.c
@@ -83,9 +83,6 @@ void default_idle(void)
  */
 void cpu_idle(void)
 {
-        if (current->pid != 0)
-                goto out;
-
         /* endless idle loop with no priority at all */
         for (;;) {
                 if (ARCH_SUN4C_SUN4) {
@@ -126,8 +123,6 @@ void cpu_idle(void)
                 schedule();
                 check_pgt_cache();
         }
-out:
-        return;
 }
 
 #else
diff --git a/arch/sparc64/kernel/pci_iommu.c b/arch/sparc64/kernel/pci_iommu.c
index 292983413ae2..33ca56c90da2 100644
--- a/arch/sparc64/kernel/pci_iommu.c
+++ b/arch/sparc64/kernel/pci_iommu.c
@@ -8,6 +8,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/delay.h>
 
 #include <asm/pbm.h>
 
@@ -379,6 +380,56 @@ bad:
         return PCI_DMA_ERROR_CODE;
 }
 
+static void pci_strbuf_flush(struct pci_strbuf *strbuf, struct pci_iommu *iommu, u32 vaddr, unsigned long ctx, unsigned long npages)
+{
+        int limit;
+
+        PCI_STC_FLUSHFLAG_INIT(strbuf);
+        if (strbuf->strbuf_ctxflush &&
+            iommu->iommu_ctxflush) {
+                unsigned long matchreg, flushreg;
+
+                flushreg = strbuf->strbuf_ctxflush;
+                matchreg = PCI_STC_CTXMATCH_ADDR(strbuf, ctx);
+
+                limit = 100000;
+                pci_iommu_write(flushreg, ctx);
+                for(;;) {
+                        if (((long)pci_iommu_read(matchreg)) >= 0L)
+                                break;
+                        limit--;
+                        if (!limit)
+                                break;
+                        udelay(1);
+                }
+                if (!limit)
+                        printk(KERN_WARNING "pci_strbuf_flush: ctx flush "
+                               "timeout vaddr[%08x] ctx[%lx]\n",
+                               vaddr, ctx);
+        } else {
+                unsigned long i;
+
+                for (i = 0; i < npages; i++, vaddr += IO_PAGE_SIZE)
+                        pci_iommu_write(strbuf->strbuf_pflush, vaddr);
+        }
+
+        pci_iommu_write(strbuf->strbuf_fsync, strbuf->strbuf_flushflag_pa);
+        (void) pci_iommu_read(iommu->write_complete_reg);
+
+        limit = 100000;
+        while (!PCI_STC_FLUSHFLAG_SET(strbuf)) {
+                limit--;
+                if (!limit)
+                        break;
+                udelay(1);
+                membar("#LoadLoad");
+        }
+        if (!limit)
+                printk(KERN_WARNING "pci_strbuf_flush: flushflag timeout "
+                       "vaddr[%08x] ctx[%lx] npages[%ld]\n",
+                       vaddr, ctx, npages);
+}
+
 /* Unmap a single streaming mode DMA translation. */
 void pci_unmap_single(struct pci_dev *pdev, dma_addr_t bus_addr, size_t sz, int direction)
 {
@@ -386,7 +437,7 @@ void pci_unmap_single(struct pci_dev *pdev, dma_addr_t bus_addr, size_t sz, int
         struct pci_iommu *iommu;
         struct pci_strbuf *strbuf;
         iopte_t *base;
-        unsigned long flags, npages, i, ctx;
+        unsigned long flags, npages, ctx;
 
         if (direction == PCI_DMA_NONE)
                 BUG();
@@ -414,29 +465,8 @@ void pci_unmap_single(struct pci_dev *pdev, dma_addr_t bus_addr, size_t sz, int
                 ctx = (iopte_val(*base) & IOPTE_CONTEXT) >> 47UL;
 
         /* Step 1: Kick data out of streaming buffers if necessary. */
-        if (strbuf->strbuf_enabled) {
-                u32 vaddr = bus_addr;
-
-                PCI_STC_FLUSHFLAG_INIT(strbuf);
-                if (strbuf->strbuf_ctxflush &&
-                    iommu->iommu_ctxflush) {
-                        unsigned long matchreg, flushreg;
-
-                        flushreg = strbuf->strbuf_ctxflush;
-                        matchreg = PCI_STC_CTXMATCH_ADDR(strbuf, ctx);
-                        do {
-                                pci_iommu_write(flushreg, ctx);
-                        } while(((long)pci_iommu_read(matchreg)) < 0L);
-                } else {
-                        for (i = 0; i < npages; i++, vaddr += IO_PAGE_SIZE)
-                                pci_iommu_write(strbuf->strbuf_pflush, vaddr);
-                }
-
-                pci_iommu_write(strbuf->strbuf_fsync, strbuf->strbuf_flushflag_pa);
-                (void) pci_iommu_read(iommu->write_complete_reg);
-                while (!PCI_STC_FLUSHFLAG_SET(strbuf))
-                        membar("#LoadLoad");
-        }
+        if (strbuf->strbuf_enabled)
+                pci_strbuf_flush(strbuf, iommu, bus_addr, ctx, npages);
 
         /* Step 2: Clear out first TSB entry. */
         iopte_make_dummy(iommu, base);
@@ -647,29 +677,8 @@ void pci_unmap_sg(struct pci_dev *pdev, struct scatterlist *sglist, int nelems,
                 ctx = (iopte_val(*base) & IOPTE_CONTEXT) >> 47UL;
 
         /* Step 1: Kick data out of streaming buffers if necessary. */
-        if (strbuf->strbuf_enabled) {
-                u32 vaddr = (u32) bus_addr;
-
-                PCI_STC_FLUSHFLAG_INIT(strbuf);
-                if (strbuf->strbuf_ctxflush &&
-                    iommu->iommu_ctxflush) {
-                        unsigned long matchreg, flushreg;
-
-                        flushreg = strbuf->strbuf_ctxflush;
-                        matchreg = PCI_STC_CTXMATCH_ADDR(strbuf, ctx);
-                        do {
-                                pci_iommu_write(flushreg, ctx);
-                        } while(((long)pci_iommu_read(matchreg)) < 0L);
-                } else {
-                        for (i = 0; i < npages; i++, vaddr += IO_PAGE_SIZE)
-                                pci_iommu_write(strbuf->strbuf_pflush, vaddr);
-                }
-
-                pci_iommu_write(strbuf->strbuf_fsync, strbuf->strbuf_flushflag_pa);
-                (void) pci_iommu_read(iommu->write_complete_reg);
-                while (!PCI_STC_FLUSHFLAG_SET(strbuf))
-                        membar("#LoadLoad");
-        }
+        if (strbuf->strbuf_enabled)
+                pci_strbuf_flush(strbuf, iommu, bus_addr, ctx, npages);
 
         /* Step 2: Clear out first TSB entry. */
         iopte_make_dummy(iommu, base);
@@ -715,28 +724,7 @@ void pci_dma_sync_single_for_cpu(struct pci_dev *pdev, dma_addr_t bus_addr, size
         }
 
         /* Step 2: Kick data out of streaming buffers. */
-        PCI_STC_FLUSHFLAG_INIT(strbuf);
-        if (iommu->iommu_ctxflush &&
-            strbuf->strbuf_ctxflush) {
-                unsigned long matchreg, flushreg;
-
-                flushreg = strbuf->strbuf_ctxflush;
-                matchreg = PCI_STC_CTXMATCH_ADDR(strbuf, ctx);
-                do {
-                        pci_iommu_write(flushreg, ctx);
-                } while(((long)pci_iommu_read(matchreg)) < 0L);
-        } else {
-                unsigned long i;
-
-                for (i = 0; i < npages; i++, bus_addr += IO_PAGE_SIZE)
-                        pci_iommu_write(strbuf->strbuf_pflush, bus_addr);
-        }
-
-        /* Step 3: Perform flush synchronization sequence. */
-        pci_iommu_write(strbuf->strbuf_fsync, strbuf->strbuf_flushflag_pa);
-        (void) pci_iommu_read(iommu->write_complete_reg);
-        while (!PCI_STC_FLUSHFLAG_SET(strbuf))
-                membar("#LoadLoad");
+        pci_strbuf_flush(strbuf, iommu, bus_addr, ctx, npages);
 
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
@@ -749,7 +737,8 @@ void pci_dma_sync_sg_for_cpu(struct pci_dev *pdev, struct scatterlist *sglist, i
         struct pcidev_cookie *pcp;
         struct pci_iommu *iommu;
         struct pci_strbuf *strbuf;
-        unsigned long flags, ctx;
+        unsigned long flags, ctx, npages, i;
+        u32 bus_addr;
 
         pcp = pdev->sysdata;
         iommu = pcp->pbm->iommu;
@@ -772,36 +761,14 @@ void pci_dma_sync_sg_for_cpu(struct pci_dev *pdev, struct scatterlist *sglist, i
         }
 
         /* Step 2: Kick data out of streaming buffers. */
-        PCI_STC_FLUSHFLAG_INIT(strbuf);
-        if (iommu->iommu_ctxflush &&
-            strbuf->strbuf_ctxflush) {
-                unsigned long matchreg, flushreg;
-
-                flushreg = strbuf->strbuf_ctxflush;
-                matchreg = PCI_STC_CTXMATCH_ADDR(strbuf, ctx);
-                do {
-                        pci_iommu_write(flushreg, ctx);
-                } while (((long)pci_iommu_read(matchreg)) < 0L);
-        } else {
-                unsigned long i, npages;
-                u32 bus_addr;
-
-                bus_addr = sglist[0].dma_address & IO_PAGE_MASK;
-
-                for(i = 1; i < nelems; i++)
-                        if (!sglist[i].dma_length)
-                                break;
-                i--;
-                npages = (IO_PAGE_ALIGN(sglist[i].dma_address + sglist[i].dma_length) - bus_addr) >> IO_PAGE_SHIFT;
-                for (i = 0; i < npages; i++, bus_addr += IO_PAGE_SIZE)
-                        pci_iommu_write(strbuf->strbuf_pflush, bus_addr);
-        }
-
-        /* Step 3: Perform flush synchronization sequence. */
-        pci_iommu_write(strbuf->strbuf_fsync, strbuf->strbuf_flushflag_pa);
-        (void) pci_iommu_read(iommu->write_complete_reg);
-        while (!PCI_STC_FLUSHFLAG_SET(strbuf))
-                membar("#LoadLoad");
+        bus_addr = sglist[0].dma_address & IO_PAGE_MASK;
+        for(i = 1; i < nelems; i++)
+                if (!sglist[i].dma_length)
+                        break;
+        i--;
+        npages = (IO_PAGE_ALIGN(sglist[i].dma_address + sglist[i].dma_length)
+                  - bus_addr) >> IO_PAGE_SHIFT;
+        pci_strbuf_flush(strbuf, iommu, bus_addr, ctx, npages);
 
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
diff --git a/arch/sparc64/kernel/process.c b/arch/sparc64/kernel/process.c
index 26d3ec41da1c..a0cd2b2494d6 100644
--- a/arch/sparc64/kernel/process.c
+++ b/arch/sparc64/kernel/process.c
@@ -62,9 +62,6 @@ void default_idle(void)
  */
 void cpu_idle(void)
 {
-        if (current->pid != 0)
-                return;
-
         /* endless idle loop with no priority at all */
         for (;;) {
                 /* If current->work.need_resched is zero we should really
@@ -80,7 +77,6 @@ void cpu_idle(void)
                 schedule();
                 check_pgt_cache();
         }
-        return;
 }
 
 #else
diff --git a/arch/sparc64/kernel/sbus.c b/arch/sparc64/kernel/sbus.c
index 14d9c3a21b9a..76ea6455433f 100644
--- a/arch/sparc64/kernel/sbus.c
+++ b/arch/sparc64/kernel/sbus.c
@@ -117,19 +117,34 @@ static void iommu_flush(struct sbus_iommu *iommu, u32 base, unsigned long npages
 
 #define STRBUF_TAG_VALID        0x02UL
 
-static void strbuf_flush(struct sbus_iommu *iommu, u32 base, unsigned long npages)
+static void sbus_strbuf_flush(struct sbus_iommu *iommu, u32 base, unsigned long npages)
 {
+        unsigned long n;
+        int limit;
+
         iommu->strbuf_flushflag = 0UL;
-        while (npages--)
-                upa_writeq(base + (npages << IO_PAGE_SHIFT),
+        n = npages;
+        while (n--)
+                upa_writeq(base + (n << IO_PAGE_SHIFT),
                            iommu->strbuf_regs + STRBUF_PFLUSH);
 
         /* Whoopee cushion! */
         upa_writeq(__pa(&iommu->strbuf_flushflag),
                    iommu->strbuf_regs + STRBUF_FSYNC);
         upa_readq(iommu->sbus_control_reg);
-        while (iommu->strbuf_flushflag == 0UL)
+
+        limit = 100000;
+        while (iommu->strbuf_flushflag == 0UL) {
+                limit--;
+                if (!limit)
+                        break;
+                udelay(1);
                 membar("#LoadLoad");
+        }
+        if (!limit)
+                printk(KERN_WARNING "sbus_strbuf_flush: flushflag timeout "
+                       "vaddr[%08x] npages[%ld]\n",
+                       base, npages);
 }
 
 static iopte_t *alloc_streaming_cluster(struct sbus_iommu *iommu, unsigned long npages)
@@ -406,7 +421,7 @@ void sbus_unmap_single(struct sbus_dev *sdev, dma_addr_t dma_addr, size_t size,
 
         spin_lock_irqsave(&iommu->lock, flags);
         free_streaming_cluster(iommu, dma_base, size >> IO_PAGE_SHIFT);
-        strbuf_flush(iommu, dma_base, size >> IO_PAGE_SHIFT);
+        sbus_strbuf_flush(iommu, dma_base, size >> IO_PAGE_SHIFT);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
@@ -569,7 +584,7 @@ void sbus_unmap_sg(struct sbus_dev *sdev, struct scatterlist *sg, int nents, int
         iommu = sdev->bus->iommu;
         spin_lock_irqsave(&iommu->lock, flags);
         free_streaming_cluster(iommu, dvma_base, size >> IO_PAGE_SHIFT);
-        strbuf_flush(iommu, dvma_base, size >> IO_PAGE_SHIFT);
+        sbus_strbuf_flush(iommu, dvma_base, size >> IO_PAGE_SHIFT);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
@@ -581,7 +596,7 @@ void sbus_dma_sync_single_for_cpu(struct sbus_dev *sdev, dma_addr_t base, size_t
         size = (IO_PAGE_ALIGN(base + size) - (base & IO_PAGE_MASK));
 
         spin_lock_irqsave(&iommu->lock, flags);
-        strbuf_flush(iommu, base & IO_PAGE_MASK, size >> IO_PAGE_SHIFT);
+        sbus_strbuf_flush(iommu, base & IO_PAGE_MASK, size >> IO_PAGE_SHIFT);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
@@ -605,7 +620,7 @@ void sbus_dma_sync_sg_for_cpu(struct sbus_dev *sdev, struct scatterlist *sg, int
         size = IO_PAGE_ALIGN(sg[i].dma_address + sg[i].dma_length) - base;
 
         spin_lock_irqsave(&iommu->lock, flags);
-        strbuf_flush(iommu, base, size >> IO_PAGE_SHIFT);
+        sbus_strbuf_flush(iommu, base, size >> IO_PAGE_SHIFT);
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
diff --git a/arch/sparc64/kernel/sparc64_ksyms.c b/arch/sparc64/kernel/sparc64_ksyms.c
index cad5a1122800..e78cc53594fa 100644
--- a/arch/sparc64/kernel/sparc64_ksyms.c
+++ b/arch/sparc64/kernel/sparc64_ksyms.c
@@ -278,7 +278,7 @@ EXPORT_SYMBOL(verify_compat_iovec);
 
 EXPORT_SYMBOL(dump_thread);
 EXPORT_SYMBOL(dump_fpu);
-EXPORT_SYMBOL(__pte_alloc_one_kernel);
+EXPORT_SYMBOL(pte_alloc_one_kernel);
 #ifndef CONFIG_SMP
 EXPORT_SYMBOL(pgt_quicklists);
 #endif
diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
index db6fa77b4dab..9c5222075da9 100644
--- a/arch/sparc64/mm/init.c
+++ b/arch/sparc64/mm/init.c
@@ -1114,7 +1114,7 @@ struct pgtable_cache_struct pgt_quicklists;
 #else
 #define DC_ALIAS_SHIFT  0
 #endif
-pte_t *__pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
+pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
 {
         struct page *page;
         unsigned long color;
diff --git a/arch/um/Kconfig_x86_64 b/arch/um/Kconfig_x86_64
index fd8d7e8982b1..f162f50f0b17 100644
--- a/arch/um/Kconfig_x86_64
+++ b/arch/um/Kconfig_x86_64
@@ -6,6 +6,10 @@ config 64BIT
         bool
         default y
 
+config TOP_ADDR
+        hex
+        default 0x80000000
+
 config 3_LEVEL_PGTABLES
        bool
        default y
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 97bca6b5ca95..f2a0c40a9204 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -17,7 +17,7 @@ core-y			+= $(ARCH_DIR)/kernel/		\
 
 # Have to precede the include because the included Makefiles reference them.
 SYMLINK_HEADERS := archparam.h system.h sigcontext.h processor.h ptrace.h \
-        arch-signal.h module.h vm-flags.h
+        module.h vm-flags.h elf.h
 SYMLINK_HEADERS := $(foreach header,$(SYMLINK_HEADERS),include/asm-um/$(header))
 
 # XXX: The "os" symlink is only used by arch/um/include/os.h, which includes
@@ -44,6 +44,11 @@ ifneq ($(MAKEFILES-INCL),)
 endif
 
 ARCH_INCLUDE    := -I$(ARCH_DIR)/include
+ifneq ($(KBUILD_SRC),)
+ARCH_INCLUDE    += -I$(ARCH_DIR)/include2
+ARCH_INCLUDE    += -I$(srctree)/$(ARCH_DIR)/include
+MRPROPER_DIRS   += $(ARCH_DIR)/include2
+endif
 SYS_DIR         := $(ARCH_DIR)/include/sysdep-$(SUBARCH)
 
 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
@@ -94,17 +99,18 @@ define archhelp
   echo '                   find in the kernel root.'
 endef
 
+ifneq ($(KBUILD_SRC),)
+$(shell mkdir -p $(ARCH_DIR) && ln -fsn $(srctree)/$(ARCH_DIR)/Kconfig_$(SUBARCH) $(ARCH_DIR)/Kconfig_arch)
+CLEAN_FILES += $(ARCH_DIR)/Kconfig_arch
+else
 $(shell cd $(ARCH_DIR) && ln -sf Kconfig_$(SUBARCH) Kconfig_arch)
+endif
 
-prepare: $(ARCH_SYMLINKS) $(SYS_HEADERS) $(GEN_HEADERS) \
-        $(ARCH_DIR)/kernel/vmlinux.lds.S
+prepare: $(ARCH_SYMLINKS) $(SYS_HEADERS) $(GEN_HEADERS)
 
 LINK-$(CONFIG_LD_SCRIPT_STATIC) += -static
 LINK-$(CONFIG_LD_SCRIPT_DYN) += -Wl,-rpath,/lib
 
-LD_SCRIPT-$(CONFIG_LD_SCRIPT_STATIC) := uml.lds.S
-LD_SCRIPT-$(CONFIG_LD_SCRIPT_DYN) := dyn.lds.S
-
 CPP_MODE-$(CONFIG_MODE_TT) := -DMODE_TT
 CONFIG_KERNEL_STACK_ORDER ?= 2
 STACK_SIZE := $(shell echo $$[ 4096 * (1 << $(CONFIG_KERNEL_STACK_ORDER)) ] )
@@ -126,7 +132,7 @@ define cmd_vmlinux__
         $(CC) $(CFLAGS_vmlinux) -o $@ \
         -Wl,-T,$(vmlinux-lds) $(vmlinux-init) \
         -Wl,--start-group $(vmlinux-main) -Wl,--end-group \
-        -L/usr/lib -lutil \
+        -lutil \
         $(filter-out $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) \
         FORCE ,$^) ; rm -f linux
 endef
@@ -145,31 +151,42 @@ archclean:
         @find . \( -name '*.bb' -o -name '*.bbg' -o -name '*.da' \
                 -o -name '*.gcov' \) -type f -print | xargs rm -f
 
-#We need to re-preprocess this when the symlink dest changes.
-#So we touch it when needed.
-$(ARCH_DIR)/kernel/vmlinux.lds.S: FORCE
-        $(Q)if [ "$(shell readlink $@)" != "$(LD_SCRIPT-y)" ]; then \
-                echo '  SYMLINK $@'; \
-                ln -sf $(LD_SCRIPT-y) $@; \
-                touch $@; \
-        fi;
-
 $(SYMLINK_HEADERS):
         @echo '  SYMLINK $@'
+ifneq ($(KBUILD_SRC),)
+        ln -fsn $(srctree)/include/asm-um/$(basename $(notdir $@))-$(SUBARCH)$(suffix $@) $@
+else
         $(Q)cd $(TOPDIR)/$(dir $@) ; \
         ln -sf $(basename $(notdir $@))-$(SUBARCH)$(suffix $@) $(notdir $@)
+endif
 
 include/asm-um/arch:
         @echo '  SYMLINK $@'
+ifneq ($(KBUILD_SRC),)
+        $(Q)mkdir -p include/asm-um
+        $(Q)ln -fsn $(srctree)/include/asm-$(SUBARCH) include/asm-um/arch
+else
         $(Q)cd $(TOPDIR)/include/asm-um && ln -sf ../asm-$(SUBARCH) arch
+endif
 
 $(ARCH_DIR)/include/sysdep:
         @echo '  SYMLINK $@'
+ifneq ($(KBUILD_SRC),)
+        $(Q)mkdir -p $(ARCH_DIR)/include
+        $(Q)mkdir -p $(ARCH_DIR)/include2
+        $(Q)ln -fsn sysdep-$(SUBARCH) $(ARCH_DIR)/include/sysdep
+        $(Q)ln -fsn $(srctree)/$(ARCH_DIR)/include/sysdep-$(SUBARCH) $(ARCH_DIR)/include2/sysdep
+else
         $(Q)cd $(ARCH_DIR)/include && ln -sf sysdep-$(SUBARCH) sysdep
+endif
 
 $(ARCH_DIR)/os:
         @echo '  SYMLINK $@'
+ifneq ($(KBUILD_SRC),)
+        $(Q)ln -fsn $(srctree)/$(ARCH_DIR)/os-$(OS) $(ARCH_DIR)/os
+else
         $(Q)cd $(ARCH_DIR) && ln -sf os-$(OS) os
+endif
 
 # Generated files
 define filechk_umlconfig
@@ -179,10 +196,31 @@ endef
 $(ARCH_DIR)/include/uml-config.h : include/linux/autoconf.h
         $(call filechk,umlconfig)
 
+$(ARCH_DIR)/user-offsets.s: $(ARCH_DIR)/sys-$(SUBARCH)/user-offsets.c
+        $(CC) $(USER_CFLAGS) -S -o $@ $<
+
+$(ARCH_DIR)/user-offsets.h: $(ARCH_DIR)/user-offsets.s
+        $(call filechk,gen-asm-offsets)
+
+CLEAN_FILES += $(ARCH_DIR)/user-offsets.s  $(ARCH_DIR)/user-offsets.h
+
+$(ARCH_DIR)/kernel-offsets.s: $(ARCH_DIR)/sys-$(SUBARCH)/kernel-offsets.c \
+                                   $(ARCH_SYMLINKS) \
+                                   $(SYS_DIR)/sc.h \
+                                   include/asm include/linux/version.h \
+                                   include/config/MARKER \
+                                   $(ARCH_DIR)/include/user_constants.h
+        $(CC) $(CFLAGS) $(NOSTDINC_FLAGS) $(CPPFLAGS) -S -o $@ $<
+
+$(ARCH_DIR)/kernel-offsets.h: $(ARCH_DIR)/kernel-offsets.s
+        $(call filechk,gen-asm-offsets)
+
+CLEAN_FILES += $(ARCH_DIR)/kernel-offsets.s  $(ARCH_DIR)/kernel-offsets.h
+
 $(ARCH_DIR)/include/task.h: $(ARCH_DIR)/util/mk_task
         $(call filechk,gen_header)
 
-$(ARCH_DIR)/include/user_constants.h: $(ARCH_DIR)/os/util/mk_user_constants
+$(ARCH_DIR)/include/user_constants.h: $(ARCH_DIR)/os-$(OS)/util/mk_user_constants
         $(call filechk,gen_header)
 
 $(ARCH_DIR)/include/kern_constants.h: $(ARCH_DIR)/util/mk_constants
@@ -191,20 +229,20 @@ $(ARCH_DIR)/include/kern_constants.h: $(ARCH_DIR)/util/mk_constants
 $(ARCH_DIR)/include/skas_ptregs.h: $(ARCH_DIR)/kernel/skas/util/mk_ptregs
         $(call filechk,gen_header)
 
-$(ARCH_DIR)/os/util/mk_user_constants: $(ARCH_DIR)/os/util FORCE ;
+$(ARCH_DIR)/os-$(OS)/util/mk_user_constants: $(ARCH_DIR)/os-$(OS)/util FORCE ;
 
 $(ARCH_DIR)/util/mk_task $(ARCH_DIR)/util/mk_constants: $(ARCH_DIR)/include/user_constants.h $(ARCH_DIR)/util \
         FORCE ;
 
 $(ARCH_DIR)/kernel/skas/util/mk_ptregs: $(ARCH_DIR)/kernel/skas/util FORCE ;
 
-$(ARCH_DIR)/util: scripts_basic $(SYS_DIR)/sc.h FORCE
+$(ARCH_DIR)/util: scripts_basic $(SYS_DIR)/sc.h $(ARCH_DIR)/kernel-offsets.h FORCE
         $(Q)$(MAKE) $(build)=$@
 
-$(ARCH_DIR)/kernel/skas/util: scripts_basic FORCE
+$(ARCH_DIR)/kernel/skas/util: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
         $(Q)$(MAKE) $(build)=$@
 
-$(ARCH_DIR)/os/util: scripts_basic FORCE
+$(ARCH_DIR)/os-$(OS)/util: scripts_basic FORCE
         $(Q)$(MAKE) $(build)=$@
 
 export SUBARCH USER_CFLAGS OS
diff --git a/arch/um/Makefile-i386 b/arch/um/Makefile-i386
index f9e3c0f06541..29e182d5a83a 100644
--- a/arch/um/Makefile-i386
+++ b/arch/um/Makefile-i386
@@ -32,10 +32,10 @@ $(SYS_DIR)/sc.h: $(SYS_UTIL_DIR)/mk_sc
 $(SYS_DIR)/thread.h: $(SYS_UTIL_DIR)/mk_thread 
         $(call filechk,gen_header)
 
-$(SYS_UTIL_DIR)/mk_sc: scripts_basic FORCE
+$(SYS_UTIL_DIR)/mk_sc: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
         $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
 
-$(SYS_UTIL_DIR)/mk_thread: scripts_basic $(ARCH_SYMLINKS) $(GEN_HEADERS) FORCE
+$(SYS_UTIL_DIR)/mk_thread: scripts_basic $(ARCH_DIR)/kernel-offsets.h FORCE
         $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
 
 $(SYS_UTIL_DIR): scripts_basic include/asm FORCE
diff --git a/arch/um/Makefile-x86_64 b/arch/um/Makefile-x86_64
index a77971133e91..32144562c279 100644
--- a/arch/um/Makefile-x86_64
+++ b/arch/um/Makefile-x86_64
@@ -23,10 +23,10 @@ $(SYS_DIR)/sc.h: $(SYS_UTIL_DIR)/mk_sc
 $(SYS_DIR)/thread.h: $(SYS_UTIL_DIR)/mk_thread
         $(call filechk,gen_header)
 
-$(SYS_UTIL_DIR)/mk_sc: scripts_basic FORCE
+$(SYS_UTIL_DIR)/mk_sc: scripts_basic $(ARCH_DIR)/user-offsets.h FORCE
         $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
 
-$(SYS_UTIL_DIR)/mk_thread: scripts_basic $(ARCH_SYMLINKS) $(GEN_HEADERS) FORCE
+$(SYS_UTIL_DIR)/mk_thread: scripts_basic $(GEN_HEADERS) $(ARCH_DIR)/kernel-offsets.h FORCE
         $(Q)$(MAKE) $(build)=$(SYS_UTIL_DIR) $@
 
 CLEAN_FILES += $(SYS_HEADERS)
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 0150038af795..14a12d6b3df6 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -20,9 +20,17 @@
 #include "os.h"
 
 #ifdef CONFIG_NOCONFIG_CHAN
+
+/* The printk's here are wrong because we are complaining that there is no
+ * output device, but printk is printing to that output device.  The user will
+ * never see the error.  printf would be better, except it can't run on a
+ * kernel stack because it will overflow it.
+ * Use printk for now since that will avoid crashing.
+ */
+
 static void *not_configged_init(char *str, int device, struct chan_opts *opts)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(NULL);
 }
@@ -30,27 +38,27 @@ static void *not_configged_init(char *str, int device, struct chan_opts *opts)
 static int not_configged_open(int input, int output, int primary, void *data,
                               char **dev_out)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-ENODEV);
 }
 
 static void not_configged_close(int fd, void *data)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
 }
 
 static int not_configged_read(int fd, char *c_out, void *data)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
 
 static int not_configged_write(int fd, const char *buf, int len, void *data)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
@@ -58,7 +66,7 @@ static int not_configged_write(int fd, const char *buf, int len, void *data)
 static int not_configged_console_write(int fd, const char *buf, int len,
                                        void *data)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
@@ -66,7 +74,7 @@ static int not_configged_console_write(int fd, const char *buf, int len,
 static int not_configged_window_size(int fd, void *data, unsigned short *rows,
                                      unsigned short *cols)
 {
-        printf(KERN_ERR "Using a channel type which is configured out of "
+        printk(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-ENODEV);
 }
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index d0f97127adf6..025d3be8aca4 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -462,12 +462,15 @@ out:
         return err;
 }
 
+static void unregister_winch(struct tty_struct *tty);
+
 void line_close(struct tty_struct *tty, struct file * filp)
 {
         struct line *line = tty->driver_data;
 
-        /* XXX: I assume this should be called in process context, not with interrupt
-         * disabled!*/
+        /* XXX: I assume this should be called in process context, not with
+         *  interrupts disabled!
+         */
         spin_lock_irq(&line->lock);
 
         /* We ignore the error anyway! */
@@ -478,6 +481,12 @@ void line_close(struct tty_struct *tty, struct file * filp)
                 line_disable(tty, -1);
                 tty->driver_data = NULL;
         }
+
+        if((line->count == 0) && line->sigio){
+                unregister_winch(tty);
+                line->sigio = 0;
+        }
+
         spin_unlock_irq(&line->lock);
 }
 
@@ -729,6 +738,34 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_struct *tty)
         up(&winch_handler_sem);
 }
 
+static void unregister_winch(struct tty_struct *tty)
+{
+        struct list_head *ele;
+        struct winch *winch, *found = NULL;
+
+        down(&winch_handler_sem);
+        list_for_each(ele, &winch_handlers){
+                winch = list_entry(ele, struct winch, list);
+                if(winch->tty == tty){
+                        found = winch;
+                        break;
+                }
+        }
+
+        if(found == NULL)
+                goto out;
+
+        if(winch->pid != -1)
+                os_kill_process(winch->pid, 1);
+
+        free_irq_by_irq_and_dev(WINCH_IRQ, winch);
+        free_irq(WINCH_IRQ, winch);
+        list_del(&winch->list);
+        kfree(winch);
+ out:
+        up(&winch_handler_sem);
+}
+
 static void winch_cleanup(void)
 {
         struct list_head *ele;
diff --git a/arch/um/drivers/mcast_kern.c b/arch/um/drivers/mcast_kern.c
index faf714e87b5b..217438cdef33 100644
--- a/arch/um/drivers/mcast_kern.c
+++ b/arch/um/drivers/mcast_kern.c
@@ -73,7 +73,6 @@ int mcast_setup(char *str, char **mac_out, void *data)
         struct mcast_init *init = data;
         char *port_str = NULL, *ttl_str = NULL, *remain;
         char *last;
-        int n;
 
         *init = ((struct mcast_init)
                 { .addr         = "239.192.168.1",
@@ -89,13 +88,12 @@ int mcast_setup(char *str, char **mac_out, void *data)
         }
         
         if(port_str != NULL){
-                n = simple_strtoul(port_str, &last, 10);
+                init->port = simple_strtoul(port_str, &last, 10);
                 if((*last != '\0') || (last == port_str)){
                         printk(KERN_ERR "mcast_setup - Bad port : '%s'\n", 
                                port_str);
                         return(0);
                 }
-                init->port = htons(n);
         }
 
         if(ttl_str != NULL){
diff --git a/arch/um/drivers/mcast_user.c b/arch/um/drivers/mcast_user.c
index 0fe1d9fa9139..7a0d115b29d0 100644
--- a/arch/um/drivers/mcast_user.c
+++ b/arch/um/drivers/mcast_user.c
@@ -38,7 +38,7 @@ static struct sockaddr_in *new_addr(char *addr, unsigned short port)
         }
         sin->sin_family = AF_INET;
         sin->sin_addr.s_addr = in_aton(addr);
-        sin->sin_port = port;
+        sin->sin_port = htons(port);
         return(sin);
 }
 
@@ -55,28 +55,25 @@ static int mcast_open(void *data)
         struct mcast_data *pri = data;
         struct sockaddr_in *sin = pri->mcast_addr;
         struct ip_mreq mreq;
-        int fd, yes = 1;
+        int fd = -EINVAL, yes = 1, err = -EINVAL;;
 
 
-        if ((sin->sin_addr.s_addr == 0) || (sin->sin_port == 0)) {
-                fd = -EINVAL;
+        if ((sin->sin_addr.s_addr == 0) || (sin->sin_port == 0))
                 goto out;
-        }
 
         fd = socket(AF_INET, SOCK_DGRAM, 0);
+
         if (fd < 0){
                 printk("mcast_open : data socket failed, errno = %d\n", 
                        errno);
-                fd = -ENOMEM;
+                fd = -errno;
                 goto out;
         }
 
         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) {
                 printk("mcast_open: SO_REUSEADDR failed, errno = %d\n",
                         errno);
-                os_close_file(fd);
-                fd = -EINVAL;
-                goto out;
+                goto out_close;
         }
 
         /* set ttl according to config */
@@ -84,26 +81,20 @@ static int mcast_open(void *data)
                        sizeof(pri->ttl)) < 0) {
                 printk("mcast_open: IP_MULTICAST_TTL failed, error = %d\n",
                         errno);
-                os_close_file(fd);
-                fd = -EINVAL;
-                goto out;
+                goto out_close;
         }
 
         /* set LOOP, so data does get fed back to local sockets */
         if (setsockopt(fd, SOL_IP, IP_MULTICAST_LOOP, &yes, sizeof(yes)) < 0) {
                 printk("mcast_open: IP_MULTICAST_LOOP failed, error = %d\n",
                         errno);
-                os_close_file(fd);
-                fd = -EINVAL;
-                goto out;
+                goto out_close;
         }
 
         /* bind socket to mcast address */
         if (bind(fd, (struct sockaddr *) sin, sizeof(*sin)) < 0) {
                 printk("mcast_open : data bind failed, errno = %d\n", errno);
-                os_close_file(fd);
-                fd = -EINVAL;
-                goto out;
+                goto out_close;
         }               
         
         /* subscribe to the multicast group */
@@ -117,12 +108,15 @@ static int mcast_open(void *data)
                        "interface on the host.\n");
                 printk("eth0 should be configured in order to use the "
                        "multicast transport.\n");
-                os_close_file(fd);
-                fd = -EINVAL;
+                goto out_close;
         }
 
  out:
-        return(fd);
+        return fd;
+
+ out_close:
+        os_close_file(fd);
+        return err;
 }
 
 static void mcast_close(int fd, void *data)
@@ -164,14 +158,3 @@ struct net_user_info mcast_user_info = {
         .delete_address = NULL,
         .max_packet     = MAX_PACKET - ETH_HEADER_OTHER
 };
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 9a56ff94308d..88f956c34fed 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -55,7 +55,7 @@
 #include "mem_kern.h"
 #include "cow.h"
 
-enum ubd_req { UBD_READ, UBD_WRITE, UBD_MMAP };
+enum ubd_req { UBD_READ, UBD_WRITE };
 
 struct io_thread_req {
         enum ubd_req op;
@@ -68,8 +68,6 @@ struct io_thread_req {
         unsigned long sector_mask;
         unsigned long long cow_offset;
         unsigned long bitmap_words[2];
-        int map_fd;
-        unsigned long long map_offset;
         int error;
 };
 
@@ -122,10 +120,6 @@ static int ubd_ioctl(struct inode * inode, struct file * file,
 
 #define MAX_DEV (8)
 
-/* Changed in early boot */
-static int ubd_do_mmap = 0;
-#define UBD_MMAP_BLOCK_SIZE PAGE_SIZE
-
 static struct block_device_operations ubd_blops = {
         .owner          = THIS_MODULE,
         .open           = ubd_open,
@@ -175,12 +169,6 @@ struct ubd {
         int no_cow;
         struct cow cow;
         struct platform_device pdev;
-
-        int map_writes;
-        int map_reads;
-        int nomap_writes;
-        int nomap_reads;
-        int write_maps;
 };
 
 #define DEFAULT_COW { \
@@ -200,11 +188,6 @@ struct ubd {
         .openflags =            OPEN_FLAGS, \
         .no_cow =               0, \
         .cow =                  DEFAULT_COW, \
-        .map_writes             = 0, \
-        .map_reads              = 0, \
-        .nomap_writes           = 0, \
-        .nomap_reads            = 0, \
-        .write_maps             = 0, \
 }
 
 struct ubd ubd_dev[MAX_DEV] = { [ 0 ... MAX_DEV - 1 ] = DEFAULT_UBD };
@@ -314,13 +297,6 @@ static int ubd_setup_common(char *str, int *index_out)
                 int major;
 
                 str++;
-                if(!strcmp(str, "mmap")){
-                        CHOOSE_MODE(printk("mmap not supported by the ubd "
-                                           "driver in tt mode\n"),
-                                    ubd_do_mmap = 1);
-                        return(0);
-                }
-
                 if(!strcmp(str, "sync")){
                         global_openflags = of_sync(global_openflags);
                         return(0);
@@ -524,7 +500,7 @@ static void ubd_handler(void)
 {
         struct io_thread_req req;
         struct request *rq = elv_next_request(ubd_queue);
-        int n, err;
+        int n;
 
         do_ubd = NULL;
         intr_count++;
@@ -538,19 +514,6 @@ static void ubd_handler(void)
                 return;
         }
         
-        if((req.op != UBD_MMAP) &&
-           ((req.offset != ((__u64) (rq->sector)) << 9) ||
-            (req.length != (rq->current_nr_sectors) << 9)))
-                panic("I/O op mismatch");
-        
-        if(req.map_fd != -1){
-                err = physmem_subst_mapping(req.buffer, req.map_fd,
-                                            req.map_offset, 1);
-                if(err)
-                        printk("ubd_handler - physmem_subst_mapping failed, "
-                               "err = %d\n", -err);
-        }
-
         ubd_finish(rq, req.error);
         reactivate_fd(thread_fd, UBD_IRQ);      
         do_ubd_request(ubd_queue);
@@ -583,14 +546,10 @@ static int ubd_file_size(struct ubd *dev, __u64 *size_out)
 
 static void ubd_close(struct ubd *dev)
 {
-        if(ubd_do_mmap)
-                physmem_forget_descriptor(dev->fd);
         os_close_file(dev->fd);
         if(dev->cow.file == NULL)
                 return;
 
-        if(ubd_do_mmap)
-                physmem_forget_descriptor(dev->cow.fd);
         os_close_file(dev->cow.fd);
         vfree(dev->cow.bitmap);
         dev->cow.bitmap = NULL;
@@ -1010,94 +969,13 @@ static void cowify_req(struct io_thread_req *req, unsigned long *bitmap,
                            req->bitmap_words, bitmap_len);
 }
 
-static int mmap_fd(struct request *req, struct ubd *dev, __u64 offset)
-{
-        __u64 sector;
-        unsigned char *bitmap;
-        int bit, i;
-
-        /* mmap must have been requested on the command line */
-        if(!ubd_do_mmap)
-                return(-1);
-
-        /* The buffer must be page aligned */
-        if(((unsigned long) req->buffer % UBD_MMAP_BLOCK_SIZE) != 0)
-                return(-1);
-
-        /* The request must be a page long */
-        if((req->current_nr_sectors << 9) != PAGE_SIZE)
-                return(-1);
-
-        if(dev->cow.file == NULL)
-                return(dev->fd);
-
-        sector = offset >> 9;
-        bitmap = (unsigned char *) dev->cow.bitmap;
-        bit = ubd_test_bit(sector, bitmap);
-
-        for(i = 1; i < req->current_nr_sectors; i++){
-                if(ubd_test_bit(sector + i, bitmap) != bit)
-                        return(-1);
-        }
-
-        if(bit || (rq_data_dir(req) == WRITE))
-                offset += dev->cow.data_offset;
-
-        /* The data on disk must be page aligned */
-        if((offset % UBD_MMAP_BLOCK_SIZE) != 0)
-                return(-1);
-
-        return(bit ? dev->fd : dev->cow.fd);
-}
-
-static int prepare_mmap_request(struct ubd *dev, int fd, __u64 offset,
-                                struct request *req,
-                                struct io_thread_req *io_req)
-{
-        int err;
-
-        if(rq_data_dir(req) == WRITE){
-                /* Writes are almost no-ops since the new data is already in the
-                 * host page cache
-                 */
-                dev->map_writes++;
-                if(dev->cow.file != NULL)
-                        cowify_bitmap(io_req->offset, io_req->length,
-                                      &io_req->sector_mask, &io_req->cow_offset,
-                                      dev->cow.bitmap, dev->cow.bitmap_offset,
-                                      io_req->bitmap_words,
-                                      dev->cow.bitmap_len);
-        }
-        else {
-                int w;
-
-                if((dev->cow.file != NULL) && (fd == dev->cow.fd))
-                        w = 0;
-                else w = dev->openflags.w;
-
-                if((dev->cow.file != NULL) && (fd == dev->fd))
-                        offset += dev->cow.data_offset;
-
-                err = physmem_subst_mapping(req->buffer, fd, offset, w);
-                if(err){
-                        printk("physmem_subst_mapping failed, err = %d\n",
-                               -err);
-                        return(1);
-                }
-                dev->map_reads++;
-        }
-        io_req->op = UBD_MMAP;
-        io_req->buffer = req->buffer;
-        return(0);
-}
-
 /* Called with ubd_io_lock held */
 static int prepare_request(struct request *req, struct io_thread_req *io_req)
 {
         struct gendisk *disk = req->rq_disk;
         struct ubd *dev = disk->private_data;
         __u64 offset;
-        int len, fd;
+        int len;
 
         if(req->rq_status == RQ_INACTIVE) return(1);
 
@@ -1114,34 +992,12 @@ static int prepare_request(struct request *req, struct io_thread_req *io_req)
 
         io_req->fds[0] = (dev->cow.file != NULL) ? dev->cow.fd : dev->fd;
         io_req->fds[1] = dev->fd;
-        io_req->map_fd = -1;
         io_req->cow_offset = -1;
         io_req->offset = offset;
         io_req->length = len;
         io_req->error = 0;
         io_req->sector_mask = 0;
 
-        fd = mmap_fd(req, dev, io_req->offset);
-        if(fd > 0){
-                /* If mmapping is otherwise OK, but the first access to the
-                 * page is a write, then it's not mapped in yet.  So we have
-                 * to write the data to disk first, then we can map the disk
-                 * page in and continue normally from there.
-                 */
-                if((rq_data_dir(req) == WRITE) && !is_remapped(req->buffer)){
-                        io_req->map_fd = dev->fd;
-                        io_req->map_offset = io_req->offset +
-                                dev->cow.data_offset;
-                        dev->write_maps++;
-                }
-                else return(prepare_mmap_request(dev, fd, io_req->offset, req,
-                                                 io_req));
-        }
-
-        if(rq_data_dir(req) == READ)
-                dev->nomap_reads++;
-        else dev->nomap_writes++;
-
         io_req->op = (rq_data_dir(req) == READ) ? UBD_READ : UBD_WRITE;
         io_req->offsets[0] = 0;
         io_req->offsets[1] = dev->cow.data_offset;
@@ -1229,143 +1085,6 @@ static int ubd_ioctl(struct inode * inode, struct file * file,
         return(-EINVAL);
 }
 
-static int ubd_check_remapped(int fd, unsigned long address, int is_write,
-                              __u64 offset)
-{
-        __u64 bitmap_offset;
-        unsigned long new_bitmap[2];
-        int i, err, n;
-
-        /* If it's not a write access, we can't do anything about it */
-        if(!is_write)
-                return(0);
-
-        /* We have a write */
-        for(i = 0; i < sizeof(ubd_dev) / sizeof(ubd_dev[0]); i++){
-                struct ubd *dev = &ubd_dev[i];
-
-                if((dev->fd != fd) && (dev->cow.fd != fd))
-                        continue;
-
-                /* It's a write to a ubd device */
-
-                /* This should be impossible now */
-                if(!dev->openflags.w){
-                        /* It's a write access on a read-only device - probably
-                         * shouldn't happen.  If the kernel is trying to change
-                         * something with no intention of writing it back out,
-                         * then this message will clue us in that this needs
-                         * fixing
-                         */
-                        printk("Write access to mapped page from readonly ubd "
-                               "device %d\n", i);
-                        return(0);
-                }
-
-                /* It's a write to a writeable ubd device - it must be COWed
-                 * because, otherwise, the page would have been mapped in
-                 * writeable
-                 */
-
-                if(!dev->cow.file)
-                        panic("Write fault on writeable non-COW ubd device %d",
-                              i);
-
-                /* It should also be an access to the backing file since the
-                 * COW pages should be mapped in read-write
-                 */
-
-                if(fd == dev->fd)
-                        panic("Write fault on a backing page of ubd "
-                              "device %d\n", i);
-
-                /* So, we do the write, copying the backing data to the COW
-                 * file...
-                 */
-
-                err = os_seek_file(dev->fd, offset + dev->cow.data_offset);
-                if(err < 0)
-                        panic("Couldn't seek to %lld in COW file of ubd "
-                              "device %d, err = %d",
-                              offset + dev->cow.data_offset, i, -err);
-
-                n = os_write_file(dev->fd, (void *) address, PAGE_SIZE);
-                if(n != PAGE_SIZE)
-                        panic("Couldn't copy data to COW file of ubd "
-                              "device %d, err = %d", i, -n);
-
-                /* ... updating the COW bitmap... */
-
-                cowify_bitmap(offset, PAGE_SIZE, NULL, &bitmap_offset,
-                              dev->cow.bitmap, dev->cow.bitmap_offset,
-                              new_bitmap, dev->cow.bitmap_len);
-
-                err = os_seek_file(dev->fd, bitmap_offset);
-                if(err < 0)
-                        panic("Couldn't seek to %lld in COW file of ubd "
-                              "device %d, err = %d", bitmap_offset, i, -err);
-
-                n = os_write_file(dev->fd, new_bitmap, sizeof(new_bitmap));
-                if(n != sizeof(new_bitmap))
-                        panic("Couldn't update bitmap  of ubd device %d, "
-                              "err = %d", i, -n);
-
-                /* Maybe we can map the COW page in, and maybe we can't.  If
-                 * it is a pre-V3 COW file, we can't, since the alignment will
-                 * be wrong.  If it is a V3 or later COW file which has been
-                 * moved to a system with a larger page size, then maybe we
-                 * can't, depending on the exact location of the page.
-                 */
-
-                offset += dev->cow.data_offset;
-
-                /* Remove the remapping, putting the original anonymous page
-                 * back.  If the COW file can be mapped in, that is done.
-                 * Otherwise, the COW page is read in.
-                 */
-
-                if(!physmem_remove_mapping((void *) address))
-                        panic("Address 0x%lx not remapped by ubd device %d",
-                              address, i);
-                if((offset % UBD_MMAP_BLOCK_SIZE) == 0)
-                        physmem_subst_mapping((void *) address, dev->fd,
-                                              offset, 1);
-                else {
-                        err = os_seek_file(dev->fd, offset);
-                        if(err < 0)
-                                panic("Couldn't seek to %lld in COW file of "
-                                      "ubd device %d, err = %d", offset, i,
-                                      -err);
-
-                        n = os_read_file(dev->fd, (void *) address, PAGE_SIZE);
-                        if(n != PAGE_SIZE)
-                                panic("Failed to read page from offset %llx of "
-                                      "COW file of ubd device %d, err = %d",
-                                      offset, i, -n);
-                }
-
-                return(1);
-        }
-
-        /* It's not a write on a ubd device */
-        return(0);
-}
-
-static struct remapper ubd_remapper = {
-        .list   = LIST_HEAD_INIT(ubd_remapper.list),
-        .proc   = ubd_check_remapped,
-};
-
-static int ubd_remapper_setup(void)
-{
-        if(ubd_do_mmap)
-                register_remapper(&ubd_remapper);
-
-        return(0);
-}
-
-__initcall(ubd_remapper_setup);
-
 static int same_backing_files(char *from_cmdline, char *from_cow, char *cow)
 {
         struct uml_stat buf1, buf2;
@@ -1568,15 +1287,6 @@ void do_io(struct io_thread_req *req)
         int err;
         __u64 off;
 
-        if(req->op == UBD_MMAP){
-                /* Touch the page to force the host to do any necessary IO to
-                 * get it into memory
-                 */
-                n = *((volatile int *) req->buffer);
-                req->error = update_bitmap(req);
-                return;
-        }
-
         nsectors = req->length / req->sectorsize;
         start = 0;
         do {
diff --git a/arch/um/drivers/xterm_kern.c b/arch/um/drivers/xterm_kern.c
index 7917b9d1cec8..a4fdf3584ad2 100644
--- a/arch/um/drivers/xterm_kern.c
+++ b/arch/um/drivers/xterm_kern.c
@@ -7,7 +7,6 @@
 #include "linux/slab.h"
 #include "linux/signal.h"
 #include "linux/interrupt.h"
-#include "asm/semaphore.h"
 #include "asm/irq.h"
 #include "irq_user.h"
 #include "irq_kern.h"
diff --git a/arch/um/include/common-offsets.h b/arch/um/include/common-offsets.h
new file mode 100644
index 000000000000..d705daa2d854
--- /dev/null
+++ b/arch/um/include/common-offsets.h
@@ -0,0 +1,14 @@
+/* for use by sys-$SUBARCH/kernel-offsets.c */
+
+OFFSET(TASK_REGS, task_struct, thread.regs);
+OFFSET(TASK_PID, task_struct, pid);
+DEFINE(UM_KERN_PAGE_SIZE, PAGE_SIZE);
+DEFINE(UM_NSEC_PER_SEC, NSEC_PER_SEC);
+DEFINE_STR(UM_KERN_EMERG, KERN_EMERG);
+DEFINE_STR(UM_KERN_ALERT, KERN_ALERT);
+DEFINE_STR(UM_KERN_CRIT, KERN_CRIT);
+DEFINE_STR(UM_KERN_ERR, KERN_ERR);
+DEFINE_STR(UM_KERN_WARNING, KERN_WARNING);
+DEFINE_STR(UM_KERN_NOTICE, KERN_NOTICE);
+DEFINE_STR(UM_KERN_INFO, KERN_INFO);
+DEFINE_STR(UM_KERN_DEBUG, KERN_DEBUG);
diff --git a/arch/um/include/kern_util.h b/arch/um/include/kern_util.h
index 15389c886b41..e5fec5570199 100644
--- a/arch/um/include/kern_util.h
+++ b/arch/um/include/kern_util.h
@@ -8,6 +8,7 @@
 
 #include "linux/threads.h"
 #include "sysdep/ptrace.h"
+#include "sysdep/faultinfo.h"
 
 extern int ncpus;
 extern char *linux_prog;
@@ -31,8 +32,8 @@ extern int current_pid(void);
 extern unsigned long alloc_stack(int order, int atomic);
 extern int do_signal(void);
 extern int is_stack_fault(unsigned long sp);
-extern unsigned long segv(unsigned long address, unsigned long ip, 
-                          int is_write, int is_user, void *sc);
+extern unsigned long segv(struct faultinfo fi, unsigned long ip,
+                          int is_user, void *sc);
 extern int handle_page_fault(unsigned long address, unsigned long ip,
                              int is_write, int is_user, int *code_out);
 extern void syscall_ready(void);
@@ -82,7 +83,7 @@ extern void timer_irq(union uml_pt_regs *regs);
 extern void unprotect_stack(unsigned long stack);
 extern void do_uml_exitcalls(void);
 extern int attach_debugger(int idle_pid, int pid, int stop);
-extern void bad_segv(unsigned long address, unsigned long ip, int is_write);
+extern void bad_segv(struct faultinfo fi, unsigned long ip);
 extern int config_gdb(char *str);
 extern int remove_gdb(void);
 extern char *uml_strdup(char *string);
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index 07340c8cf203..d246d5a24609 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -160,6 +160,7 @@ extern void os_kill_process(int pid, int reap_child);
 extern void os_kill_ptraced_process(int pid, int reap_child);
 extern void os_usr1_process(int pid);
 extern int os_getpid(void);
+extern int os_getpgrp(void);
 
 extern int os_map_memory(void *virt, int fd, unsigned long long off,
                          unsigned long len, int r, int w, int x);
diff --git a/arch/um/include/skas_ptrace.h b/arch/um/include/skas_ptrace.h
index cfb5fb4f5b91..cd2327d09c8d 100644
--- a/arch/um/include/skas_ptrace.h
+++ b/arch/um/include/skas_ptrace.h
@@ -6,22 +6,11 @@
 #ifndef __SKAS_PTRACE_H
 #define __SKAS_PTRACE_H
 
-struct ptrace_faultinfo {
-        int is_write;
-        unsigned long addr;
-};
-
-struct ptrace_ldt {
-        int func;
-        void *ptr;
-        unsigned long bytecount;
-};
-
 #define PTRACE_FAULTINFO 52
-#define PTRACE_SIGPENDING 53
-#define PTRACE_LDT 54
 #define PTRACE_SWITCH_MM 55
 
+#include "sysdep/skas_ptrace.h"
+
 #endif
 
 /*
diff --git a/arch/um/include/sysdep-i386/checksum.h b/arch/um/include/sysdep-i386/checksum.h
index 3a2a45811aa3..764ba4db4788 100644
--- a/arch/um/include/sysdep-i386/checksum.h
+++ b/arch/um/include/sysdep-i386/checksum.h
@@ -24,19 +24,6 @@ unsigned int csum_partial(const unsigned char * buff, int len,
                           unsigned int sum);
 
 /*
- * the same as csum_partial, but copies from src while it
- * checksums, and handles user-space pointer exceptions correctly, when needed.
- *
- * here even more important to align src and dst on a 32-bit (or even
- * better 64-bit) boundary
- */
-
-unsigned int csum_partial_copy_to(const unsigned char *src, unsigned char *dst,
-                                  int len, int sum, int *err_ptr);
-unsigned int csum_partial_copy_from(const unsigned char *src, unsigned char *dst,
-                                    int len, int sum, int *err_ptr);
-
-/*
  *      Note: when you get a NULL pointer exception here this means someone
  *      passed in an incorrect kernel address to one of these functions.
  *
@@ -52,11 +39,24 @@ unsigned int csum_partial_copy_nocheck(const unsigned char *src, unsigned char *
         return(csum_partial(dst, len, sum));
 }
 
+/*
+ * the same as csum_partial, but copies from src while it
+ * checksums, and handles user-space pointer exceptions correctly, when needed.
+ *
+ * here even more important to align src and dst on a 32-bit (or even
+ * better 64-bit) boundary
+ */
+
 static __inline__
 unsigned int csum_partial_copy_from_user(const unsigned char *src, unsigned char *dst,
                                          int len, int sum, int *err_ptr)
 {
-        return csum_partial_copy_from(src, dst, len, sum, err_ptr);
+        if(copy_from_user(dst, src, len)){
+                *err_ptr = -EFAULT;
+                return(-1);
+        }
+
+        return csum_partial(dst, len, sum);
 }
 
 /*
@@ -67,7 +67,6 @@ unsigned int csum_partial_copy_from_user(const unsigned char *src, unsigned char
  */
 
 #define csum_partial_copy_fromuser csum_partial_copy_from_user
-unsigned int csum_partial_copy(const unsigned char *src, unsigned char *dst, int len, int sum);
 
 /*
  *      This is a version of ip_compute_csum() optimized for IP headers,
@@ -196,8 +195,14 @@ static __inline__ unsigned int csum_and_copy_to_user(const unsigned char *src,
                                                      unsigned char *dst,
                                                      int len, int sum, int *err_ptr)
 {
-        if (access_ok(VERIFY_WRITE, dst, len))
-                return(csum_partial_copy_to(src, dst, len, sum, err_ptr));
+        if (access_ok(VERIFY_WRITE, dst, len)){
+                if(copy_to_user(dst, src, len)){
+                        *err_ptr = -EFAULT;
+                        return(-1);
+                }
+
+                return csum_partial(src, len, sum);
+        }
 
         if (len)
                 *err_ptr = -EFAULT;
diff --git a/arch/um/include/sysdep-i386/faultinfo.h b/arch/um/include/sysdep-i386/faultinfo.h
new file mode 100644
index 000000000000..db437cc373bc
--- /dev/null
+++ b/arch/um/include/sysdep-i386/faultinfo.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2004 Fujitsu Siemens Computers GmbH
+ * Author: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
+ * Licensed under the GPL
+ */
+
+#ifndef __FAULTINFO_I386_H
+#define __FAULTINFO_I386_H
+
+/* this structure contains the full arch-specific faultinfo
+ * from the traps.
+ * On i386, ptrace_faultinfo unfortunately doesn't provide
+ * all the info, since trap_no is missing.
+ * All common elements are defined at the same position in
+ * both structures, thus making it easy to copy the
+ * contents without knowledge about the structure elements.
+ */
+struct faultinfo {
+        int error_code; /* in ptrace_faultinfo misleadingly called is_write */
+        unsigned long cr2; /* in ptrace_faultinfo called addr */
+        int trap_no; /* missing in ptrace_faultinfo */
+};
+
+#define FAULT_WRITE(fi) ((fi).error_code & 2)
+#define FAULT_ADDRESS(fi) ((fi).cr2)
+
+#define PTRACE_FULL_FAULTINFO 0
+
+#endif
diff --git a/arch/um/include/sysdep-i386/ptrace.h b/arch/um/include/sysdep-i386/ptrace.h
index 661d495e2044..6eaeb9919983 100644
--- a/arch/um/include/sysdep-i386/ptrace.h
+++ b/arch/um/include/sysdep-i386/ptrace.h
@@ -53,17 +53,12 @@ extern int sysemu_supported;
 
 #define REGS_RESTART_SYSCALL(r) IP_RESTART_SYSCALL(REGS_IP(r))
 
-#define REGS_SEGV_IS_FIXABLE(r) SEGV_IS_FIXABLE((r)->trap_type)
-
-#define REGS_FAULT_ADDR(r) ((r)->fault_addr)
-
-#define REGS_FAULT_WRITE(r) FAULT_WRITE((r)->fault_type)
-
 #endif
 #ifndef PTRACE_SYSEMU_SINGLESTEP
 #define PTRACE_SYSEMU_SINGLESTEP 32
 #endif
 
+#include "sysdep/faultinfo.h"
 #include "choose-mode.h"
 
 union uml_pt_regs {
@@ -71,6 +66,7 @@ union uml_pt_regs {
         struct tt_regs {
                 long syscall;
                 void *sc;
+                struct faultinfo faultinfo;
         } tt;
 #endif
 #ifdef UML_CONFIG_MODE_SKAS
@@ -78,9 +74,7 @@ union uml_pt_regs {
                 unsigned long regs[HOST_FRAME_SIZE];
                 unsigned long fp[HOST_FP_SIZE];
                 unsigned long xfp[HOST_XFP_SIZE];
-                unsigned long fault_addr;
-                unsigned long fault_type;
-                unsigned long trap_type;
+                struct faultinfo faultinfo;
                 long syscall;
                 int is_user;
         } skas;
@@ -217,15 +211,8 @@ struct syscall_args {
 #define UPT_SYSCALL_NR(r) UPT_ORIG_EAX(r)
 #define UPT_SYSCALL_RET(r) UPT_EAX(r)
 
-#define UPT_SEGV_IS_FIXABLE(r) \
-        CHOOSE_MODE(SC_SEGV_IS_FIXABLE(UPT_SC(r)), \
-                    REGS_SEGV_IS_FIXABLE(&r->skas))
-
-#define UPT_FAULT_ADDR(r) \
-        __CHOOSE_MODE(SC_FAULT_ADDR(UPT_SC(r)), REGS_FAULT_ADDR(&r->skas))
-
-#define UPT_FAULT_WRITE(r) \
-        CHOOSE_MODE(SC_FAULT_WRITE(UPT_SC(r)), REGS_FAULT_WRITE(&r->skas))
+#define UPT_FAULTINFO(r) \
+        CHOOSE_MODE((&(r)->tt.faultinfo), (&(r)->skas.faultinfo))
 
 #endif
 
diff --git a/arch/um/include/sysdep-i386/sigcontext.h b/arch/um/include/sysdep-i386/sigcontext.h
index dfee589de360..1fe729265167 100644
--- a/arch/um/include/sysdep-i386/sigcontext.h
+++ b/arch/um/include/sysdep-i386/sigcontext.h
@@ -13,15 +13,12 @@
 #define SC_RESTART_SYSCALL(sc) IP_RESTART_SYSCALL(SC_IP(sc))
 #define SC_SET_SYSCALL_RETURN(sc, result) SC_EAX(sc) = (result)
 
-#define SC_FAULT_ADDR(sc) SC_CR2(sc)
-#define SC_FAULT_TYPE(sc) SC_ERR(sc)
-
-#define FAULT_WRITE(err) (err & 2)
-#define TO_SC_ERR(is_write) ((is_write) ? 2 : 0)
-
-#define SC_FAULT_WRITE(sc) (FAULT_WRITE(SC_ERR(sc)))
-
-#define SC_TRAP_TYPE(sc) SC_TRAPNO(sc)
+#define GET_FAULTINFO_FROM_SC(fi,sc) \
+        { \
+                (fi).cr2 = SC_CR2(sc); \
+                (fi).error_code = SC_ERR(sc); \
+                (fi).trap_no = SC_TRAPNO(sc); \
+        }
 
 /* ptrace expects that, at the start of a system call, %eax contains
  * -ENOSYS, so this makes it so.
@@ -29,9 +26,7 @@
 #define SC_START_SYSCALL(sc) do SC_EAX(sc) = -ENOSYS; while(0)
 
 /* This is Page Fault */
-#define SEGV_IS_FIXABLE(trap) (trap == 14)
-
-#define SC_SEGV_IS_FIXABLE(sc) (SEGV_IS_FIXABLE(SC_TRAPNO(sc)))
+#define SEGV_IS_FIXABLE(fi) ((fi)->trap_no == 14)
 
 extern unsigned long *sc_sigmask(void *sc_ptr);
 extern int sc_get_fpregs(unsigned long buf, void *sc_ptr);
diff --git a/arch/um/include/sysdep-i386/signal.h b/arch/um/include/sysdep-i386/signal.h
index b1e1f7a77499..07518b162136 100644
--- a/arch/um/include/sysdep-i386/signal.h
+++ b/arch/um/include/sysdep-i386/signal.h
@@ -8,6 +8,8 @@
 
 #include <signal.h>
 
+#define ARCH_SIGHDLR_PARAM int sig
+
 #define ARCH_GET_SIGCONTEXT(sc, sig) \
         do sc = (struct sigcontext *) (&sig + 1); while(0)
 
diff --git a/arch/um/include/sysdep-i386/skas_ptrace.h b/arch/um/include/sysdep-i386/skas_ptrace.h
new file mode 100644
index 000000000000..e27b8a791773
--- /dev/null
+++ b/arch/um/include/sysdep-i386/skas_ptrace.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2000, 2001, 2002 Jeff Dike (jdike@karaya.com)
+ * Licensed under the GPL
+ */
+
+#ifndef __SYSDEP_I386_SKAS_PTRACE_H
+#define __SYSDEP_I386_SKAS_PTRACE_H
+
+struct ptrace_faultinfo {
+        int is_write;
+        unsigned long addr;
+};
+
+struct ptrace_ldt {
+        int func;
+        void *ptr;
+        unsigned long bytecount;
+};
+
+#define PTRACE_LDT 54
+
+#endif
diff --git a/arch/um/include/sysdep-ia64/skas_ptrace.h b/arch/um/include/sysdep-ia64/skas_ptrace.h
new file mode 100644
index 000000000000..25a38e715702
--- /dev/null
+++ b/arch/um/include/sysdep-ia64/skas_ptrace.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2000, 2001, 2002 Jeff Dike (jdike@karaya.com)
+ * Licensed under the GPL
+ */
+
+#ifndef __SYSDEP_IA64_SKAS_PTRACE_H
+#define __SYSDEP_IA64_SKAS_PTRACE_H
+
+struct ptrace_faultinfo {
+        int is_write;
+        unsigned long addr;
+};
+
+struct ptrace_ldt {
+        int func;
+        void *ptr;
+        unsigned long bytecount;
+};
+
+#define PTRACE_LDT 54
+
+#endif
diff --git a/arch/um/include/sysdep-ppc/skas_ptrace.h b/arch/um/include/sysdep-ppc/skas_ptrace.h
new file mode 100644
index 000000000000..d9fbbac10de0
--- /dev/null
+++ b/arch/um/include/sysdep-ppc/skas_ptrace.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2000, 2001, 2002 Jeff Dike (jdike@karaya.com)
+ * Licensed under the GPL
+ */
+
+#ifndef __SYSDEP_PPC_SKAS_PTRACE_H
+#define __SYSDEP_PPC_SKAS_PTRACE_H
+
+struct ptrace_faultinfo {
+        int is_write;
+        unsigned long addr;
+};
+
+struct ptrace_ldt {
+        int func;
+        void *ptr;
+        unsigned long bytecount;
+};
+
+#define PTRACE_LDT 54
+
+#endif
diff --git a/arch/um/include/sysdep-x86_64/checksum.h b/arch/um/include/sysdep-x86_64/checksum.h
index 572c6c19be33..ea97005af694 100644
--- a/arch/um/include/sysdep-x86_64/checksum.h
+++ b/arch/um/include/sysdep-x86_64/checksum.h
@@ -9,8 +9,6 @@
 #include "linux/in6.h"
 #include "asm/uaccess.h"
 
-extern unsigned int csum_partial_copy_from(const unsigned char *src, unsigned char *dst, int len,
-                                           int sum, int *err_ptr);
 extern unsigned csum_partial(const unsigned char *buff, unsigned len,
                              unsigned sum);
 
@@ -31,10 +29,15 @@ unsigned int csum_partial_copy_nocheck(const unsigned char *src, unsigned char *
 }
 
 static __inline__
-unsigned int csum_partial_copy_from_user(const unsigned char *src, unsigned char *dst,
-                                         int len, int sum, int *err_ptr)
+unsigned int csum_partial_copy_from_user(const unsigned char *src,
+                                         unsigned char *dst, int len, int sum,
+                                         int *err_ptr)
 {
-        return csum_partial_copy_from(src, dst, len, sum, err_ptr);
+        if(copy_from_user(dst, src, len)){
+                *err_ptr = -EFAULT;
+                return(-1);
+        }
+        return csum_partial(dst, len, sum);
 }
 
 /**
@@ -137,15 +140,6 @@ static inline unsigned add32_with_carry(unsigned a, unsigned b)
         return a;
 }
 
-#endif
+extern unsigned short ip_compute_csum(unsigned char * buff, int len);
 
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
+#endif
diff --git a/arch/um/include/sysdep-x86_64/faultinfo.h b/arch/um/include/sysdep-x86_64/faultinfo.h
new file mode 100644
index 000000000000..cb917b0d5660
--- /dev/null
+++ b/arch/um/include/sysdep-x86_64/faultinfo.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2004 Fujitsu Siemens Computers GmbH
+ * Author: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
+ * Licensed under the GPL
+ */
+
+#ifndef __FAULTINFO_X86_64_H
+#define __FAULTINFO_X86_64_H
+
+/* this structure contains the full arch-specific faultinfo
+ * from the traps.
+ * On i386, ptrace_faultinfo unfortunately doesn't provide
+ * all the info, since trap_no is missing.
+ * All common elements are defined at the same position in
+ * both structures, thus making it easy to copy the
+ * contents without knowledge about the structure elements.
+ */
+struct faultinfo {
+        int error_code; /* in ptrace_faultinfo misleadingly called is_write */
+        unsigned long cr2; /* in ptrace_faultinfo called addr */
+        int trap_no; /* missing in ptrace_faultinfo */
+};
+
+#define FAULT_WRITE(fi) ((fi).error_code & 2)
+#define FAULT_ADDRESS(fi) ((fi).cr2)
+
+#define PTRACE_FULL_FAULTINFO 1
+
+#endif
diff --git a/arch/um/include/sysdep-x86_64/ptrace.h b/arch/um/include/sysdep-x86_64/ptrace.h
index 915c82daffbd..be8acd5efd97 100644
--- a/arch/um/include/sysdep-x86_64/ptrace.h
+++ b/arch/um/include/sysdep-x86_64/ptrace.h
@@ -9,6 +9,7 @@
 
 #include "uml-config.h"
 #include "user_constants.h"
+#include "sysdep/faultinfo.h"
 
 #define MAX_REG_OFFSET (UM_FRAME_SIZE)
 #define MAX_REG_NR ((MAX_REG_OFFSET) / sizeof(unsigned long))
@@ -83,6 +84,7 @@ union uml_pt_regs {
                 long syscall;
                 unsigned long orig_rax;
                 void *sc;
+                struct faultinfo faultinfo;
         } tt;
 #endif
 #ifdef UML_CONFIG_MODE_SKAS
@@ -90,9 +92,7 @@ union uml_pt_regs {
                 /* XXX */
                 unsigned long regs[27];
                 unsigned long fp[65];
-                unsigned long fault_addr;
-                unsigned long fault_type;
-                unsigned long trap_type;
+                struct faultinfo faultinfo;
                 long syscall;
                 int is_user;
         } skas;
@@ -135,6 +135,7 @@ extern int mode_tt;
         __CHOOSE_MODE(SC_EFLAGS(UPT_SC(r)), REGS_EFLAGS((r)->skas.regs))
 #define UPT_SC(r) ((r)->tt.sc)
 #define UPT_SYSCALL_NR(r) __CHOOSE_MODE((r)->tt.syscall, (r)->skas.syscall)
+#define UPT_SYSCALL_RET(r) UPT_RAX(r)
 
 extern int user_context(unsigned long sp);
 
@@ -196,32 +197,32 @@ struct syscall_args {
 
 
 #define UPT_SET(regs, reg, val) \
-        ({      unsigned long val; \
+        ({      unsigned long __upt_val = val; \
                 switch(reg){ \
-                case R8: UPT_R8(regs) = val; break; \
-                case R9: UPT_R9(regs) = val; break; \
-                case R10: UPT_R10(regs) = val; break; \
-                case R11: UPT_R11(regs) = val; break; \
-                case R12: UPT_R12(regs) = val; break; \
-                case R13: UPT_R13(regs) = val; break; \
-                case R14: UPT_R14(regs) = val; break; \
-                case R15: UPT_R15(regs) = val; break; \
-                case RIP: UPT_IP(regs) = val; break; \
-                case RSP: UPT_SP(regs) = val; break; \
-                case RAX: UPT_RAX(regs) = val; break; \
-                case RBX: UPT_RBX(regs) = val; break; \
-                case RCX: UPT_RCX(regs) = val; break; \
-                case RDX: UPT_RDX(regs) = val; break; \
-                case RSI: UPT_RSI(regs) = val; break; \
-                case RDI: UPT_RDI(regs) = val; break; \
-                case RBP: UPT_RBP(regs) = val; break; \
-                case ORIG_RAX: UPT_ORIG_RAX(regs) = val; break; \
-                case CS: UPT_CS(regs) = val; break; \
-                case DS: UPT_DS(regs) = val; break; \
-                case ES: UPT_ES(regs) = val; break; \
-                case FS: UPT_FS(regs) = val; break; \
-                case GS: UPT_GS(regs) = val; break; \
-                case EFLAGS: UPT_EFLAGS(regs) = val; break; \
+                case R8: UPT_R8(regs) = __upt_val; break; \
+                case R9: UPT_R9(regs) = __upt_val; break; \
+                case R10: UPT_R10(regs) = __upt_val; break; \
+                case R11: UPT_R11(regs) = __upt_val; break; \
+                case R12: UPT_R12(regs) = __upt_val; break; \
+                case R13: UPT_R13(regs) = __upt_val; break; \
+                case R14: UPT_R14(regs) = __upt_val; break; \
+                case R15: UPT_R15(regs) = __upt_val; break; \
+                case RIP: UPT_IP(regs) = __upt_val; break; \
+                case RSP: UPT_SP(regs) = __upt_val; break; \
+                case RAX: UPT_RAX(regs) = __upt_val; break; \
+                case RBX: UPT_RBX(regs) = __upt_val; break; \
+                case RCX: UPT_RCX(regs) = __upt_val; break; \
+                case RDX: UPT_RDX(regs) = __upt_val; break; \
+                case RSI: UPT_RSI(regs) = __upt_val; break; \
+                case RDI: UPT_RDI(regs) = __upt_val; break; \
+                case RBP: UPT_RBP(regs) = __upt_val; break; \
+                case ORIG_RAX: UPT_ORIG_RAX(regs) = __upt_val; break; \
+                case CS: UPT_CS(regs) = __upt_val; break; \
+                case DS: UPT_DS(regs) = __upt_val; break; \
+                case ES: UPT_ES(regs) = __upt_val; break; \
+                case FS: UPT_FS(regs) = __upt_val; break; \
+                case GS: UPT_GS(regs) = __upt_val; break; \
+                case EFLAGS: UPT_EFLAGS(regs) = __upt_val; break; \
                 default :  \
                         panic("Bad register in UPT_SET : %d\n", reg);  \
                         break; \
@@ -241,24 +242,7 @@ struct syscall_args {
         CHOOSE_MODE(SC_SEGV_IS_FIXABLE(UPT_SC(r)), \
                     REGS_SEGV_IS_FIXABLE(&r->skas))
 
-#define UPT_FAULT_ADDR(r) \
-        __CHOOSE_MODE(SC_FAULT_ADDR(UPT_SC(r)), REGS_FAULT_ADDR(&r->skas))
-
-#define UPT_FAULT_WRITE(r) \
-        CHOOSE_MODE(SC_FAULT_WRITE(UPT_SC(r)), REGS_FAULT_WRITE(&r->skas))
-
-#define UPT_TRAP(r) __CHOOSE_MODE(SC_TRAP_TYPE(UPT_SC(r)), REGS_TRAP(&r->skas))
-#define UPT_ERR(r) __CHOOSE_MODE(SC_FAULT_TYPE(UPT_SC(r)), REGS_ERR(&r->skas))
+#define UPT_FAULTINFO(r) \
+        CHOOSE_MODE((&(r)->tt.faultinfo), (&(r)->skas.faultinfo))
 
 #endif
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/include/sysdep-x86_64/sigcontext.h b/arch/um/include/sysdep-x86_64/sigcontext.h
index 1e38a54ff4cf..2a78260d15a0 100644
--- a/arch/um/include/sysdep-x86_64/sigcontext.h
+++ b/arch/um/include/sysdep-x86_64/sigcontext.h
@@ -17,11 +17,12 @@
 #define SC_FAULT_ADDR(sc) SC_CR2(sc)
 #define SC_FAULT_TYPE(sc) SC_ERR(sc)
 
-#define FAULT_WRITE(err) ((err) & 2)
-
-#define SC_FAULT_WRITE(sc) FAULT_WRITE(SC_FAULT_TYPE(sc))
-
-#define SC_TRAP_TYPE(sc) SC_TRAPNO(sc)
+#define GET_FAULTINFO_FROM_SC(fi,sc) \
+        { \
+                (fi).cr2 = SC_CR2(sc); \
+                (fi).error_code = SC_ERR(sc); \
+                (fi).trap_no = SC_TRAPNO(sc); \
+        }
 
 /* ptrace expects that, at the start of a system call, %eax contains
  * -ENOSYS, so this makes it so.
@@ -29,8 +30,8 @@
 
 #define SC_START_SYSCALL(sc) do SC_RAX(sc) = -ENOSYS; while(0)
 
-#define SEGV_IS_FIXABLE(trap) ((trap) == 14)
-#define SC_SEGV_IS_FIXABLE(sc) SEGV_IS_FIXABLE(SC_TRAP_TYPE(sc))
+/* This is Page Fault */
+#define SEGV_IS_FIXABLE(fi) ((fi)->trap_no == 14)
 
 extern unsigned long *sc_sigmask(void *sc_ptr);
 
diff --git a/arch/um/include/sysdep-x86_64/signal.h b/arch/um/include/sysdep-x86_64/signal.h
index e5e52756fab4..6142897af3d1 100644
--- a/arch/um/include/sysdep-x86_64/signal.h
+++ b/arch/um/include/sysdep-x86_64/signal.h
@@ -6,6 +6,8 @@
 #ifndef __X86_64_SIGNAL_H_
 #define __X86_64_SIGNAL_H_
 
+#define ARCH_SIGHDLR_PARAM int sig
+
 #define ARCH_GET_SIGCONTEXT(sc, sig_addr) \
         do { \
                 struct ucontext *__uc; \
diff --git a/arch/um/include/sysdep-x86_64/skas_ptrace.h b/arch/um/include/sysdep-x86_64/skas_ptrace.h
new file mode 100644
index 000000000000..95db4be786e4
--- /dev/null
+++ b/arch/um/include/sysdep-x86_64/skas_ptrace.h
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2000, 2001, 2002 Jeff Dike (jdike@karaya.com)
+ * Licensed under the GPL
+ */
+
+#ifndef __SYSDEP_X86_64_SKAS_PTRACE_H
+#define __SYSDEP_X86_64_SKAS_PTRACE_H
+
+struct ptrace_faultinfo {
+        int is_write;
+        unsigned long addr;
+};
+
+struct ptrace_ldt {
+        int func;
+        void *ptr;
+        unsigned long bytecount;
+};
+
+#define PTRACE_LDT 54
+
+#endif
diff --git a/arch/um/include/user_util.h b/arch/um/include/user_util.h
index 103cd320386c..b8c5b8a95250 100644
--- a/arch/um/include/user_util.h
+++ b/arch/um/include/user_util.h
@@ -67,7 +67,6 @@ extern void *um_kmalloc(int size);
 extern int switcheroo(int fd, int prot, void *from, void *to, int size);
 extern void setup_machinename(char *machine_out);
 extern void setup_hostinfo(void);
-extern void add_arg(char *arg);
 extern void init_new_thread_stack(void *sig_stack, void (*usr1_handler)(int));
 extern void init_new_thread_signals(int altstack);
 extern void do_exec(int old_pid, int new_pid);
diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
index 246f0e7fb4cc..a8918e80df96 100644
--- a/arch/um/kernel/Makefile
+++ b/arch/um/kernel/Makefile
@@ -4,9 +4,9 @@
 #
 
 extra-y := vmlinux.lds
-clean-files := vmlinux.lds.S config.tmp
+clean-files :=
 
-obj-y = checksum.o config.o exec_kern.o exitcode.o \
+obj-y = config.o exec_kern.o exitcode.o \
         helper.o init_task.o irq.o irq_user.o ksyms.o main.o mem.o mem_user.o \
         physmem.o process.o process_kern.o ptrace.o reboot.o resource.o \
         sigio_user.o sigio_kern.o signal_kern.o signal_user.o smp.o \
@@ -14,7 +14,7 @@ obj-y = checksum.o config.o exec_kern.o exitcode.o \
         tlb.o trap_kern.o trap_user.o uaccess_user.o um_arch.o umid.o \
         user_util.o
 
-obj-$(CONFIG_BLK_DEV_INITRD) += initrd_kern.o initrd_user.o
+obj-$(CONFIG_BLK_DEV_INITRD) += initrd.o
 obj-$(CONFIG_GPROF)     += gprof_syms.o
 obj-$(CONFIG_GCOV)      += gmon_syms.o
 obj-$(CONFIG_TTY_LOG)   += tty_log.o
@@ -23,18 +23,14 @@ obj-$(CONFIG_SYSCALL_DEBUG) += syscall_user.o
 obj-$(CONFIG_MODE_TT) += tt/
 obj-$(CONFIG_MODE_SKAS) += skas/
 
-# This needs be compiled with frame pointers regardless of how the rest of the
-# kernel is built.
-CFLAGS_frame.o := -fno-omit-frame-pointer
-
 user-objs-$(CONFIG_TTY_LOG) += tty_log.o
 
 USER_OBJS := $(user-objs-y) config.o helper.o main.o process.o tempfile.o \
-        time.o tty_log.o umid.o user_util.o frame.o
+        time.o tty_log.o umid.o user_util.o
 
 include arch/um/scripts/Makefile.rules
 
-targets += config.c
+targets := config.c config.tmp
 
 # Be careful with the below Sed code - sed is pitfall-rich!
 # We use sed to lower build requirements, for "embedded" builders for instance.
diff --git a/arch/um/kernel/checksum.c b/arch/um/kernel/checksum.c
deleted file mode 100644
index e69b2be951d1..000000000000
--- a/arch/um/kernel/checksum.c
+++ /dev/null
@@ -1,36 +0,0 @@
-#include "asm/uaccess.h"
-#include "linux/errno.h"
-#include "linux/module.h"
-
-unsigned int arch_csum_partial(const unsigned char *buff, int len, int sum);
-
-unsigned int csum_partial(unsigned char *buff, int len, int sum)
-{
-        return arch_csum_partial(buff, len, sum);
-}
-
-EXPORT_SYMBOL(csum_partial);
-
-unsigned int csum_partial_copy_to(const unsigned char *src,
-                                  unsigned char __user *dst, int len, int sum,
-                                  int *err_ptr)
-{
-        if(copy_to_user(dst, src, len)){
-                *err_ptr = -EFAULT;
-                return(-1);
-        }
-
-        return(arch_csum_partial(src, len, sum));
-}
-
-unsigned int csum_partial_copy_from(const unsigned char __user *src,
-                                    unsigned char *dst, int len, int sum,
-                                    int *err_ptr)
-{
-        if(copy_from_user(dst, src, len)){
-                *err_ptr = -EFAULT;
-                return(-1);
-        }
-
-        return arch_csum_partial(dst, len, sum);
-}
diff --git a/arch/um/kernel/initrd.c b/arch/um/kernel/initrd.c
new file mode 100644
index 000000000000..82ecf904b09c
--- /dev/null
+++ b/arch/um/kernel/initrd.c
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2000, 2001, 2002 Jeff Dike (jdike@karaya.com)
+ * Licensed under the GPL
+ */
+
+#include "linux/init.h"
+#include "linux/bootmem.h"
+#include "linux/initrd.h"
+#include "asm/types.h"
+#include "user_util.h"
+#include "kern_util.h"
+#include "initrd.h"
+#include "init.h"
+#include "os.h"
+
+/* Changed by uml_initrd_setup, which is a setup */
+static char *initrd __initdata = NULL;
+
+static int __init read_initrd(void)
+{
+        void *area;
+        long long size;
+        int err;
+
+        if(initrd == NULL) return 0;
+        err = os_file_size(initrd, &size);
+        if(err) return 0;
+        area = alloc_bootmem(size);
+        if(area == NULL) return 0;
+        if(load_initrd(initrd, area, size) == -1) return 0;
+        initrd_start = (unsigned long) area;
+        initrd_end = initrd_start + size;
+        return 0;
+}
+
+__uml_postsetup(read_initrd);
+
+static int __init uml_initrd_setup(char *line, int *add)
+{
+        initrd = line;
+        return 0;
+}
+
+__uml_setup("initrd=", uml_initrd_setup,
+"initrd=<initrd image>\n"
+"    This is used to boot UML from an initrd image.  The argument is the\n"
+"    name of the file containing the image.\n\n"
+);
+
+int load_initrd(char *filename, void *buf, int size)
+{
+        int fd, n;
+
+        fd = os_open_file(filename, of_read(OPENFLAGS()), 0);
+        if(fd < 0){
+                printk("Opening '%s' failed - err = %d\n", filename, -fd);
+                return(-1);
+        }
+        n = os_read_file(fd, buf, size);
+        if(n != size){
+                printk("Read of %d bytes from '%s' failed, err = %d\n", size,
+                       filename, -n);
+                return(-1);
+        }
+
+        os_close_file(fd);
+        return(0);
+}
+/*
+ * Overrides for Emacs so that we follow Linus's tabbing style.
+ * Emacs will notice this stuff at the end of the file and automatically
+ * adjust the settings for this buffer only.  This must remain at the end
+ * of the file.
+ * ---------------------------------------------------------------------------
+ * Local variables:
+ * c-file-style: "linux"
+ * End:
+ */
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index d71e8f00810f..d44fb5282547 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -163,7 +163,6 @@ void __init init_IRQ(void)
                 irq_desc[i].handler = &SIGIO_irq_type;
                 enable_irq(i);
         }
-        init_irq_signals(0);
 }
 
 /*
diff --git a/arch/um/kernel/irq_user.c b/arch/um/kernel/irq_user.c
index 6d6f9484b884..b3074cbaa479 100644
--- a/arch/um/kernel/irq_user.c
+++ b/arch/um/kernel/irq_user.c
@@ -236,9 +236,15 @@ static void free_irq_by_cb(int (*test)(struct irq_fd *, void *), void *arg)
                                        (*prev)->fd, pollfds[i].fd);
                                 goto out;
                         }
-                        memcpy(&pollfds[i], &pollfds[i + 1],
-                               (pollfds_num - i - 1) * sizeof(pollfds[0]));
+
                         pollfds_num--;
+
+                        /* This moves the *whole* array after pollfds[i] (though
+                         * it doesn't spot as such)! */
+
+                        memmove(&pollfds[i], &pollfds[i + 1],
+                               (pollfds_num - i) * sizeof(pollfds[0]));
+
                         if(last_irq_ptr == &old_fd->next) 
                                 last_irq_ptr = prev;
                         *prev = (*prev)->next;
diff --git a/arch/um/kernel/ksyms.c b/arch/um/kernel/ksyms.c
index b41d3397d07b..99439fa15ef4 100644
--- a/arch/um/kernel/ksyms.c
+++ b/arch/um/kernel/ksyms.c
@@ -10,7 +10,6 @@
 #include "linux/spinlock.h"
 #include "linux/highmem.h"
 #include "asm/current.h"
-#include "asm/delay.h"
 #include "asm/processor.h"
 #include "asm/unistd.h"
 #include "asm/pgalloc.h"
@@ -28,8 +27,6 @@ EXPORT_SYMBOL(uml_physmem);
 EXPORT_SYMBOL(set_signals);
 EXPORT_SYMBOL(get_signals);
 EXPORT_SYMBOL(kernel_thread);
-EXPORT_SYMBOL(__const_udelay);
-EXPORT_SYMBOL(__udelay);
 EXPORT_SYMBOL(sys_waitpid);
 EXPORT_SYMBOL(task_size);
 EXPORT_SYMBOL(flush_tlb_range);
@@ -60,6 +57,7 @@ EXPORT_SYMBOL(copy_to_user_tt);
 EXPORT_SYMBOL(strncpy_from_user_skas);
 EXPORT_SYMBOL(copy_to_user_skas);
 EXPORT_SYMBOL(copy_from_user_skas);
+EXPORT_SYMBOL(clear_user_skas);
 #endif
 EXPORT_SYMBOL(uml_strdup);
 
diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c
index f156661781cb..c22825f13e40 100644
--- a/arch/um/kernel/mem.c
+++ b/arch/um/kernel/mem.c
@@ -100,12 +100,37 @@ void mem_init(void)
 #endif
 }
 
+/*
+ * Create a page table and place a pointer to it in a middle page
+ * directory entry.
+ */
+static void __init one_page_table_init(pmd_t *pmd)
+{
+        if (pmd_none(*pmd)) {
+                pte_t *pte = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
+                set_pmd(pmd, __pmd(_KERNPG_TABLE +
+                                           (unsigned long) __pa(pte)));
+                if (pte != pte_offset_kernel(pmd, 0))
+                        BUG();
+        }
+}
+
+static void __init one_md_table_init(pud_t *pud)
+{
+#ifdef CONFIG_3_LEVEL_PGTABLES
+        pmd_t *pmd_table = (pmd_t *) alloc_bootmem_low_pages(PAGE_SIZE);
+        set_pud(pud, __pud(_KERNPG_TABLE + (unsigned long) __pa(pmd_table)));
+        if (pmd_table != pmd_offset(pud, 0))
+                BUG();
+#endif
+}
+
 static void __init fixrange_init(unsigned long start, unsigned long end, 
                                  pgd_t *pgd_base)
 {
         pgd_t *pgd;
+        pud_t *pud;
         pmd_t *pmd;
-        pte_t *pte;
         int i, j;
         unsigned long vaddr;
 
@@ -115,15 +140,12 @@ static void __init fixrange_init(unsigned long start, unsigned long end,
         pgd = pgd_base + i;
 
         for ( ; (i < PTRS_PER_PGD) && (vaddr < end); pgd++, i++) {
-                pmd = (pmd_t *)pgd;
+                pud = pud_offset(pgd, vaddr);
+                if (pud_none(*pud))
+                        one_md_table_init(pud);
+                pmd = pmd_offset(pud, vaddr);
                 for (; (j < PTRS_PER_PMD) && (vaddr != end); pmd++, j++) {
-                        if (pmd_none(*pmd)) {
-                                pte = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
-                                set_pmd(pmd, __pmd(_KERNPG_TABLE + 
-                                                   (unsigned long) __pa(pte)));
-                                if (pte != pte_offset_kernel(pmd, 0))
-                                        BUG();
-                        }
+                        one_page_table_init(pmd);
                         vaddr += PMD_SIZE;
                 }
                 j = 0;
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index f76a2692adca..51f8e5a8ac6a 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -65,8 +65,6 @@ void init_new_thread_signals(int altstack)
                     SIGUSR1, SIGIO, SIGWINCH, SIGALRM, SIGVTALRM, -1);
         set_handler(SIGBUS, (__sighandler_t) sig_handler, flags, 
                     SIGUSR1, SIGIO, SIGWINCH, SIGALRM, SIGVTALRM, -1);
-        set_handler(SIGWINCH, (__sighandler_t) sig_handler, flags, 
-                    SIGUSR1, SIGIO, SIGWINCH, SIGALRM, SIGVTALRM, -1);
         set_handler(SIGUSR2, (__sighandler_t) sig_handler, 
                     flags, SIGUSR1, SIGIO, SIGWINCH, SIGALRM, SIGVTALRM, -1);
         signal(SIGHUP, SIG_IGN);
diff --git a/arch/um/kernel/process_kern.c b/arch/um/kernel/process_kern.c
index 7a943696f950..c1adf7ba3fd1 100644
--- a/arch/um/kernel/process_kern.c
+++ b/arch/um/kernel/process_kern.c
@@ -115,16 +115,6 @@ int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
         return(pid);
 }
 
-void switch_mm(struct mm_struct *prev, struct mm_struct *next, 
-               struct task_struct *tsk)
-{
-        int cpu = smp_processor_id();
-
-        if (prev != next) 
-                cpu_clear(cpu, prev->cpu_vm_mask);
-        cpu_set(cpu, next->cpu_vm_mask);
-}
-
 void set_current(void *t)
 {
         struct task_struct *task = t;
@@ -152,7 +142,6 @@ void release_thread(struct task_struct *task)
  
 void exit_thread(void)
 {
-        CHOOSE_MODE(exit_thread_tt(), exit_thread_skas());
         unprotect_stack((unsigned long) current_thread);
 }
  
@@ -476,12 +465,21 @@ int singlestepping(void * t)
         return 2;
 }
 
+/*
+ * Only x86 and x86_64 have an arch_align_stack().
+ * All other arches have "#define arch_align_stack(x) (x)"
+ * in their asm/system.h
+ * As this is included in UML from asm-um/system-generic.h,
+ * we can use it to behave as the subarch does.
+ */
+#ifndef arch_align_stack
 unsigned long arch_align_stack(unsigned long sp)
 {
         if (randomize_va_space)
                 sp -= get_random_int() % 8192;
         return sp & ~0xf;
 }
+#endif
 
 
 /*
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 959b2d2490df..2925e15324de 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -19,15 +19,30 @@
 #include "skas_ptrace.h"
 #include "sysdep/ptrace.h"
 
+static inline void set_singlestepping(struct task_struct *child, int on)
+{
+        if (on)
+                child->ptrace |= PT_DTRACE;
+        else
+                child->ptrace &= ~PT_DTRACE;
+        child->thread.singlestep_syscall = 0;
+
+#ifdef SUBARCH_SET_SINGLESTEPPING
+        SUBARCH_SET_SINGLESTEPPING(child, on);
+#endif
+}
+
 /*
  * Called by kernel/ptrace.c when detaching..
  */
 void ptrace_disable(struct task_struct *child)
 { 
-        child->ptrace &= ~PT_DTRACE;
-        child->thread.singlestep_syscall = 0;
+        set_singlestepping(child,0);
 }
 
+extern int peek_user(struct task_struct * child, long addr, long data);
+extern int poke_user(struct task_struct * child, long addr, long data);
+
 long sys_ptrace(long request, long pid, long addr, long data)
 {
         struct task_struct *child;
@@ -67,6 +82,10 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 goto out_tsk;
         }
 
+#ifdef SUBACH_PTRACE_SPECIAL
+        SUBARCH_PTRACE_SPECIAL(child,request,addr,data);
+#endif
+
         ret = ptrace_check_attach(child, request == PTRACE_KILL);
         if (ret < 0)
                 goto out_tsk;
@@ -87,26 +106,9 @@ long sys_ptrace(long request, long pid, long addr, long data)
         }
 
         /* read the word at location addr in the USER area. */
-        case PTRACE_PEEKUSR: {
-                unsigned long tmp;
-
-                ret = -EIO;
-                if ((addr & 3) || addr < 0) 
-                        break;
-
-                tmp = 0;  /* Default return condition */
-                if(addr < MAX_REG_OFFSET){
-                        tmp = getreg(child, addr);
-                }
-                else if((addr >= offsetof(struct user, u_debugreg[0])) &&
-                        (addr <= offsetof(struct user, u_debugreg[7]))){
-                        addr -= offsetof(struct user, u_debugreg[0]);
-                        addr = addr >> 2;
-                        tmp = child->thread.arch.debugregs[addr];
-                }
-                ret = put_user(tmp, (unsigned long __user *) data);
-                break;
-        }
+        case PTRACE_PEEKUSR:
+                ret = peek_user(child, addr, data);
+                break;
 
         /* when I and D space are separate, this will have to be fixed. */
         case PTRACE_POKETEXT: /* write the word at location addr. */
@@ -119,26 +121,8 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 break;
 
         case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
-                ret = -EIO;
-                if ((addr & 3) || addr < 0)
-                        break;
-
-                if (addr < MAX_REG_OFFSET) {
-                        ret = putreg(child, addr, data);
-                        break;
-                }
-#if 0 /* XXX x86_64 */
-                else if((addr >= offsetof(struct user, u_debugreg[0])) &&
-                        (addr <= offsetof(struct user, u_debugreg[7]))){
-                          addr -= offsetof(struct user, u_debugreg[0]);
-                          addr = addr >> 2;
-                          if((addr == 4) || (addr == 5)) break;
-                          child->thread.arch.debugregs[addr] = data;
-                          ret = 0;
-                }
-#endif
-
-                break;
+                ret = poke_user(child, addr, data);
+                break;
 
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
@@ -146,8 +130,7 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 if (!valid_signal(data))
                         break;
 
-                child->ptrace &= ~PT_DTRACE;
-                child->thread.singlestep_syscall = 0;
+                set_singlestepping(child, 0);
                 if (request == PTRACE_SYSCALL) {
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 }
@@ -170,8 +153,7 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 if (child->exit_state == EXIT_ZOMBIE)   /* already dead */
                         break;
 
-                child->ptrace &= ~PT_DTRACE;
-                child->thread.singlestep_syscall = 0;
+                set_singlestepping(child, 0);
                 child->exit_code = SIGKILL;
                 wake_up_process(child);
                 break;
@@ -182,8 +164,7 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
-                child->ptrace |= PT_DTRACE;
-                child->thread.singlestep_syscall = 0;
+                set_singlestepping(child, 1);
                 child->exit_code = data;
                 /* give it a chance to run. */
                 wake_up_process(child);
@@ -250,23 +231,19 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 break;
 #endif
         case PTRACE_FAULTINFO: {
-                struct ptrace_faultinfo fault;
-
-                fault = ((struct ptrace_faultinfo) 
-                        { .is_write     = child->thread.err,
-                          .addr         = child->thread.cr2 });
-                ret = copy_to_user((unsigned long __user *) data, &fault,
-                                   sizeof(fault));
+                /* Take the info from thread->arch->faultinfo,
+                 * but transfer max. sizeof(struct ptrace_faultinfo).
+                 * On i386, ptrace_faultinfo is smaller!
+                 */
+                ret = copy_to_user((unsigned long __user *) data,
+                                   &child->thread.arch.faultinfo,
+                                   sizeof(struct ptrace_faultinfo));
                 if(ret)
                         break;
                 break;
         }
-        case PTRACE_SIGPENDING:
-                ret = copy_to_user((unsigned long __user *) data,
-                                   &child->pending.signal,
-                                   sizeof(child->pending.signal));
-                break;
 
+#ifdef PTRACE_LDT
         case PTRACE_LDT: {
                 struct ptrace_ldt ldt;
 
@@ -282,6 +259,7 @@ long sys_ptrace(long request, long pid, long addr, long data)
                 ret = -EIO;
                 break;
         }
+#endif
 #ifdef CONFIG_PROC_MM
         case PTRACE_SWITCH_MM: {
                 struct mm_struct *old = child->mm;
diff --git a/arch/um/kernel/sigio_user.c b/arch/um/kernel/sigio_user.c
index 668df13d8c9d..e89218958f38 100644
--- a/arch/um/kernel/sigio_user.c
+++ b/arch/um/kernel/sigio_user.c
@@ -182,6 +182,7 @@ static int write_sigio_thread(void *unused)
         int i, n, respond_fd;
         char c;
 
+        signal(SIGWINCH, SIG_IGN);
         fds = &current_poll;
         while(1){
                 n = poll(fds->poll, fds->used, -1);
diff --git a/arch/um/kernel/skas/include/mode_kern-skas.h b/arch/um/kernel/skas/include/mode_kern-skas.h
index 94c564962378..e48490028111 100644
--- a/arch/um/kernel/skas/include/mode_kern-skas.h
+++ b/arch/um/kernel/skas/include/mode_kern-skas.h
@@ -18,7 +18,6 @@ extern int copy_thread_skas(int nr, unsigned long clone_flags,
                             unsigned long sp, unsigned long stack_top,
                             struct task_struct *p, struct pt_regs *regs);
 extern void release_thread_skas(struct task_struct *task);
-extern void exit_thread_skas(void);
 extern void initial_thread_cb_skas(void (*proc)(void *), void *arg);
 extern void init_idle_skas(void);
 extern void flush_tlb_kernel_range_skas(unsigned long start,
diff --git a/arch/um/kernel/skas/include/skas.h b/arch/um/kernel/skas/include/skas.h
index f0702c2c7204..96b51dba3471 100644
--- a/arch/um/kernel/skas/include/skas.h
+++ b/arch/um/kernel/skas/include/skas.h
@@ -27,9 +27,10 @@ extern void map(int fd, unsigned long virt, unsigned long len, int r, int w,
 extern int unmap(int fd, void *addr, unsigned long len);
 extern int protect(int fd, unsigned long addr, unsigned long len, 
                    int r, int w, int x);
-extern void user_signal(int sig, union uml_pt_regs *regs);
+extern void user_signal(int sig, union uml_pt_regs *regs, int pid);
 extern int new_mm(int from);
 extern void start_userspace(int cpu);
+extern void get_skas_faultinfo(int pid, struct faultinfo * fi);
 extern long execute_syscall_skas(void *r);
 
 #endif
diff --git a/arch/um/kernel/skas/include/uaccess-skas.h b/arch/um/kernel/skas/include/uaccess-skas.h
index c35620385da0..cd6c280482cb 100644
--- a/arch/um/kernel/skas/include/uaccess-skas.h
+++ b/arch/um/kernel/skas/include/uaccess-skas.h
@@ -18,8 +18,8 @@
           ((unsigned long) (addr) + (size) <= FIXADDR_USER_END) && \
           ((unsigned long) (addr) + (size) >= (unsigned long)(addr))))
 
-static inline int __deprecated verify_area_skas(int type, const void * addr,
-                                   unsigned long size)
+static inline int verify_area_skas(int type, const void * addr,
+                                   unsigned long size)
 {
         return(access_ok_skas(type, addr, size) ? 0 : -EFAULT);
 }
diff --git a/arch/um/kernel/skas/process.c b/arch/um/kernel/skas/process.c
index b4ffaaa81241..773cd2b525fc 100644
--- a/arch/um/kernel/skas/process.c
+++ b/arch/um/kernel/skas/process.c
@@ -4,6 +4,7 @@
  */
 
 #include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 #include <errno.h>
 #include <signal.h>
@@ -27,27 +28,37 @@
 #include "chan_user.h"
 #include "signal_user.h"
 #include "registers.h"
+#include "process.h"
 
 int is_skas_winch(int pid, int fd, void *data)
 {
-        if(pid != os_getpid())
+        if(pid != os_getpgrp())
                 return(0);
 
         register_winch_irq(-1, fd, -1, data);
         return(1);
 }
 
-static void handle_segv(int pid)
+void get_skas_faultinfo(int pid, struct faultinfo * fi)
 {
-        struct ptrace_faultinfo fault;
         int err;
 
-        err = ptrace(PTRACE_FAULTINFO, pid, 0, &fault);
+        err = ptrace(PTRACE_FAULTINFO, pid, 0, fi);
         if(err)
-                panic("handle_segv - PTRACE_FAULTINFO failed, errno = %d\n",
-                      errno);
+                panic("get_skas_faultinfo - PTRACE_FAULTINFO failed, "
+                      "errno = %d\n", errno);
+
+        /* Special handling for i386, which has different structs */
+        if (sizeof(struct ptrace_faultinfo) < sizeof(struct faultinfo))
+                memset((char *)fi + sizeof(struct ptrace_faultinfo), 0,
+                       sizeof(struct faultinfo) -
+                       sizeof(struct ptrace_faultinfo));
+}
 
-        segv(fault.addr, 0, FAULT_WRITE(fault.is_write), 1, NULL);
+static void handle_segv(int pid, union uml_pt_regs * regs)
+{
+        get_skas_faultinfo(pid, &regs->skas.faultinfo);
+        segv(regs->skas.faultinfo, 0, 1, NULL);
 }
 
 /*To use the same value of using_sysemu as the caller, ask it that value (in local_using_sysemu)*/
@@ -163,7 +174,7 @@ void userspace(union uml_pt_regs *regs)
                 if(WIFSTOPPED(status)){
                         switch(WSTOPSIG(status)){
                         case SIGSEGV:
-                                handle_segv(pid);
+                                handle_segv(pid, regs);
                                 break;
                         case SIGTRAP + 0x80:
                                 handle_trap(pid, regs, local_using_sysemu);
@@ -177,7 +188,7 @@ void userspace(union uml_pt_regs *regs)
                         case SIGBUS:
                         case SIGFPE:
                         case SIGWINCH:
-                                user_signal(WSTOPSIG(status), regs);
+                                user_signal(WSTOPSIG(status), regs, pid);
                                 break;
                         default:
                                 printk("userspace - child stopped with signal "
@@ -190,6 +201,11 @@ void userspace(union uml_pt_regs *regs)
                 }
         }
 }
+#define INIT_JMP_NEW_THREAD 0
+#define INIT_JMP_REMOVE_SIGSTACK 1
+#define INIT_JMP_CALLBACK 2
+#define INIT_JMP_HALT 3
+#define INIT_JMP_REBOOT 4
 
 void new_thread(void *stack, void **switch_buf_ptr, void **fork_buf_ptr,
                 void (*handler)(int))
@@ -225,7 +241,7 @@ void thread_wait(void *sw, void *fb)
         *switch_buf = &buf;
         fork_buf = fb;
         if(sigsetjmp(buf, 1) == 0)
-                siglongjmp(*fork_buf, 1);
+                siglongjmp(*fork_buf, INIT_JMP_REMOVE_SIGSTACK);
 }
 
 void switch_threads(void *me, void *next)
@@ -249,23 +265,31 @@ int start_idle_thread(void *stack, void *switch_buf_ptr, void **fork_buf_ptr)
         sigjmp_buf **switch_buf = switch_buf_ptr;
         int n;
 
+        set_handler(SIGWINCH, (__sighandler_t) sig_handler,
+                    SA_ONSTACK | SA_RESTART, SIGUSR1, SIGIO, SIGALRM,
+                    SIGVTALRM, -1);
+
         *fork_buf_ptr = &initial_jmpbuf;
         n = sigsetjmp(initial_jmpbuf, 1);
-        if(n == 0)
-                new_thread_proc((void *) stack, new_thread_handler);
-        else if(n == 1)
-                remove_sigstack();
-        else if(n == 2){
+        switch(n){
+        case INIT_JMP_NEW_THREAD:
+                new_thread_proc((void *) stack, new_thread_handler);
+                break;
+        case INIT_JMP_REMOVE_SIGSTACK:
+                remove_sigstack();
+                break;
+        case INIT_JMP_CALLBACK:
                 (*cb_proc)(cb_arg);
                 siglongjmp(*cb_back, 1);
-        }
-        else if(n == 3){
+                break;
+        case INIT_JMP_HALT:
                 kmalloc_ok = 0;
                 return(0);
-        }
-        else if(n == 4){
+        case INIT_JMP_REBOOT:
                 kmalloc_ok = 0;
                 return(1);
+        default:
+                panic("Bad sigsetjmp return in start_idle_thread - %d\n", n);
         }
         siglongjmp(**switch_buf, 1);
 }
@@ -290,7 +314,7 @@ void initial_thread_cb_skas(void (*proc)(void *), void *arg)
 
         block_signals();
         if(sigsetjmp(here, 1) == 0)
-                siglongjmp(initial_jmpbuf, 2);
+                siglongjmp(initial_jmpbuf, INIT_JMP_CALLBACK);
         unblock_signals();
 
         cb_proc = NULL;
@@ -301,13 +325,13 @@ void initial_thread_cb_skas(void (*proc)(void *), void *arg)
 void halt_skas(void)
 {
         block_signals();
-        siglongjmp(initial_jmpbuf, 3);
+        siglongjmp(initial_jmpbuf, INIT_JMP_HALT);
 }
 
 void reboot_skas(void)
 {
         block_signals();
-        siglongjmp(initial_jmpbuf, 4);
+        siglongjmp(initial_jmpbuf, INIT_JMP_REBOOT);
 }
 
 void switch_mm_skas(int mm_fd)
diff --git a/arch/um/kernel/skas/process_kern.c b/arch/um/kernel/skas/process_kern.c
index 5d096ea63b97..ab5d3271da0b 100644
--- a/arch/um/kernel/skas/process_kern.c
+++ b/arch/um/kernel/skas/process_kern.c
@@ -83,10 +83,6 @@ void release_thread_skas(struct task_struct *task)
 {
 }
 
-void exit_thread_skas(void)
-{
-}
-
 void fork_handler(int sig)
 {
         change_sig(SIGUSR1, 1);
diff --git a/arch/um/kernel/skas/trap_user.c b/arch/um/kernel/skas/trap_user.c
index 8e9b46d4702e..0dee1d95c806 100644
--- a/arch/um/kernel/skas/trap_user.c
+++ b/arch/um/kernel/skas/trap_user.c
@@ -5,12 +5,15 @@
 
 #include <signal.h>
 #include <errno.h>
-#include "sysdep/ptrace.h"
 #include "signal_user.h"
 #include "user_util.h"
 #include "kern_util.h"
 #include "task.h"
 #include "sigcontext.h"
+#include "skas.h"
+#include "ptrace_user.h"
+#include "sysdep/ptrace.h"
+#include "sysdep/ptrace_user.h"
 
 void sig_handler_common_skas(int sig, void *sc_ptr)
 {
@@ -31,9 +34,11 @@ void sig_handler_common_skas(int sig, void *sc_ptr)
         r = &TASK_REGS(get_current())->skas;
         save_user = r->is_user;
         r->is_user = 0;
-        r->fault_addr = SC_FAULT_ADDR(sc);
-        r->fault_type = SC_FAULT_TYPE(sc);
-        r->trap_type = SC_TRAP_TYPE(sc);
+        if ( sig == SIGFPE || sig == SIGSEGV ||
+             sig == SIGBUS || sig == SIGILL ||
+             sig == SIGTRAP ) {
+                GET_FAULTINFO_FROM_SC(r->faultinfo, sc);
+        }
 
         change_sig(SIGUSR1, 1);
         info = &sig_info[sig];
@@ -45,14 +50,17 @@ void sig_handler_common_skas(int sig, void *sc_ptr)
         r->is_user = save_user;
 }
 
-void user_signal(int sig, union uml_pt_regs *regs)
+extern int ptrace_faultinfo;
+
+void user_signal(int sig, union uml_pt_regs *regs, int pid)
 {
         struct signal_info *info;
+        int segv = ((sig == SIGFPE) || (sig == SIGSEGV) || (sig == SIGBUS) ||
+                    (sig == SIGILL) || (sig == SIGTRAP));
 
         regs->skas.is_user = 1;
-        regs->skas.fault_addr = 0;
-        regs->skas.fault_type = 0;
-        regs->skas.trap_type = 0;
+        if (segv)
+                get_skas_faultinfo(pid, &regs->skas.faultinfo);
         info = &sig_info[sig];
         (*info->handler)(sig, regs);
 
diff --git a/arch/um/kernel/skas/uaccess.c b/arch/um/kernel/skas/uaccess.c
index f7da9d027672..75195281081e 100644
--- a/arch/um/kernel/skas/uaccess.c
+++ b/arch/um/kernel/skas/uaccess.c
@@ -29,9 +29,12 @@ static unsigned long maybe_map(unsigned long virt, int is_write)
         if(IS_ERR(phys) || (is_write && !pte_write(pte))){
                 err = handle_page_fault(virt, 0, is_write, 1, &dummy_code);
                 if(err)
-                        return(0);
+                        return(-1UL);
                 phys = um_virt_to_phys(current, virt, NULL);
         }
+        if(IS_ERR(phys))
+                phys = (void *) -1;
+
         return((unsigned long) phys);
 }
 
@@ -42,7 +45,7 @@ static int do_op(unsigned long addr, int len, int is_write,
         int n;
 
         addr = maybe_map(addr, is_write);
-        if(addr == -1)
+        if(addr == -1UL)
                 return(-1);
 
         page = phys_to_page(addr);
diff --git a/arch/um/kernel/skas/util/Makefile b/arch/um/kernel/skas/util/Makefile
index 17f5909d60f7..f7b7eba83340 100644
--- a/arch/um/kernel/skas/util/Makefile
+++ b/arch/um/kernel/skas/util/Makefile
@@ -2,3 +2,4 @@ hostprogs-y		:= mk_ptregs
 always                  := $(hostprogs-y)
 
 mk_ptregs-objs := mk_ptregs-$(SUBARCH).o
+HOSTCFLAGS_mk_ptregs-$(SUBARCH).o := -I$(objtree)/arch/um
diff --git a/arch/um/kernel/skas/util/mk_ptregs-i386.c b/arch/um/kernel/skas/util/mk_ptregs-i386.c
index 0788dd05bcac..1f96e1eeb8a7 100644
--- a/arch/um/kernel/skas/util/mk_ptregs-i386.c
+++ b/arch/um/kernel/skas/util/mk_ptregs-i386.c
@@ -1,8 +1,7 @@
 #include <stdio.h>
-#include <asm/ptrace.h>
-#include <asm/user.h>
+#include <user-offsets.h>
 
-#define PRINT_REG(name, val) printf("#define HOST_%s %d\n", (name), (val))
+#define SHOW(name) printf("#define %s %d\n", #name, name)
 
 int main(int argc, char **argv)
 {
@@ -12,28 +11,27 @@ int main(int argc, char **argv)
         printf("#ifndef __SKAS_PT_REGS_\n");
         printf("#define __SKAS_PT_REGS_\n");
         printf("\n");
-        printf("#define HOST_FRAME_SIZE %d\n", FRAME_SIZE);
-        printf("#define HOST_FP_SIZE %d\n",
-               sizeof(struct user_i387_struct) / sizeof(unsigned long));
-        printf("#define HOST_XFP_SIZE %d\n",
-               sizeof(struct user_fxsr_struct) / sizeof(unsigned long));
+        SHOW(HOST_FRAME_SIZE);
+        SHOW(HOST_FP_SIZE);
+        SHOW(HOST_XFP_SIZE);
+
+        SHOW(HOST_IP);
+        SHOW(HOST_SP);
+        SHOW(HOST_EFLAGS);
+        SHOW(HOST_EAX);
+        SHOW(HOST_EBX);
+        SHOW(HOST_ECX);
+        SHOW(HOST_EDX);
+        SHOW(HOST_ESI);
+        SHOW(HOST_EDI);
+        SHOW(HOST_EBP);
+        SHOW(HOST_CS);
+        SHOW(HOST_SS);
+        SHOW(HOST_DS);
+        SHOW(HOST_FS);
+        SHOW(HOST_ES);
+        SHOW(HOST_GS);
 
-        PRINT_REG("IP", EIP);
-        PRINT_REG("SP", UESP);
-        PRINT_REG("EFLAGS", EFL);
-        PRINT_REG("EAX", EAX);
-        PRINT_REG("EBX", EBX);
-        PRINT_REG("ECX", ECX);
-        PRINT_REG("EDX", EDX);
-        PRINT_REG("ESI", ESI);
-        PRINT_REG("EDI", EDI);
-        PRINT_REG("EBP", EBP);
-        PRINT_REG("CS", CS);
-        PRINT_REG("SS", SS);
-        PRINT_REG("DS", DS);
-        PRINT_REG("FS", FS);
-        PRINT_REG("ES", ES);
-        PRINT_REG("GS", GS);
         printf("\n");
         printf("#endif\n");
         return(0);
diff --git a/arch/um/kernel/skas/util/mk_ptregs-x86_64.c b/arch/um/kernel/skas/util/mk_ptregs-x86_64.c
index 67aee92a70ef..5fccbfe35f78 100644
--- a/arch/um/kernel/skas/util/mk_ptregs-x86_64.c
+++ b/arch/um/kernel/skas/util/mk_ptregs-x86_64.c
@@ -5,11 +5,10 @@
  */
 
 #include <stdio.h>
-#define __FRAME_OFFSETS
-#include <asm/ptrace.h>
+#include <user-offsets.h>
 
-#define PRINT_REG(name, val) \
-        printf("#define HOST_%s (%d / sizeof(unsigned long))\n", (name), (val))
+#define SHOW(name) \
+        printf("#define %s (%d / sizeof(unsigned long))\n", #name, name)
 
 int main(int argc, char **argv)
 {
@@ -18,36 +17,35 @@ int main(int argc, char **argv)
         printf("\n");
         printf("#ifndef __SKAS_PT_REGS_\n");
         printf("#define __SKAS_PT_REGS_\n");
-        printf("#define HOST_FRAME_SIZE (%d / sizeof(unsigned long))\n",
-               FRAME_SIZE);
-        PRINT_REG("RBX", RBX);
-        PRINT_REG("RCX", RCX);
-        PRINT_REG("RDI", RDI);
-        PRINT_REG("RSI", RSI);
-        PRINT_REG("RDX", RDX);
-        PRINT_REG("RBP", RBP);
-        PRINT_REG("RAX", RAX);
-        PRINT_REG("R8", R8);
-        PRINT_REG("R9", R9);
-        PRINT_REG("R10", R10);
-        PRINT_REG("R11", R11);
-        PRINT_REG("R12", R12);
-        PRINT_REG("R13", R13);
-        PRINT_REG("R14", R14);
-        PRINT_REG("R15", R15);
-        PRINT_REG("ORIG_RAX", ORIG_RAX);
-        PRINT_REG("CS", CS);
-        PRINT_REG("SS", SS);
-        PRINT_REG("EFLAGS", EFLAGS);
+        SHOW(HOST_FRAME_SIZE);
+        SHOW(HOST_RBX);
+        SHOW(HOST_RCX);
+        SHOW(HOST_RDI);
+        SHOW(HOST_RSI);
+        SHOW(HOST_RDX);
+        SHOW(HOST_RBP);
+        SHOW(HOST_RAX);
+        SHOW(HOST_R8);
+        SHOW(HOST_R9);
+        SHOW(HOST_R10);
+        SHOW(HOST_R11);
+        SHOW(HOST_R12);
+        SHOW(HOST_R13);
+        SHOW(HOST_R14);
+        SHOW(HOST_R15);
+        SHOW(HOST_ORIG_RAX);
+        SHOW(HOST_CS);
+        SHOW(HOST_SS);
+        SHOW(HOST_EFLAGS);
 #if 0
-        PRINT_REG("FS", FS);
-        PRINT_REG("GS", GS);
-        PRINT_REG("DS", DS);
-        PRINT_REG("ES", ES);
+        SHOW(HOST_FS);
+        SHOW(HOST_GS);
+        SHOW(HOST_DS);
+        SHOW(HOST_ES);
 #endif
 
-        PRINT_REG("IP", RIP);
-        PRINT_REG("SP", RSP);
+        SHOW(HOST_IP);
+        SHOW(HOST_SP);
         printf("#define HOST_FP_SIZE 0\n");
         printf("#define HOST_XFP_SIZE 0\n");
         printf("\n");
diff --git a/arch/um/kernel/syscall_kern.c b/arch/um/kernel/syscall_kern.c
index 42731e04f50f..b7a55251e897 100644
--- a/arch/um/kernel/syscall_kern.c
+++ b/arch/um/kernel/syscall_kern.c
@@ -17,7 +17,6 @@
 #include "linux/utime.h"
 #include "asm/mman.h"
 #include "asm/uaccess.h"
-#include "asm/ipc.h"
 #include "kern_util.h"
 #include "user_util.h"
 #include "sysdep/syscalls.h"
diff --git a/arch/um/kernel/time_kern.c b/arch/um/kernel/time_kern.c
index 2461cd73ca87..6516fc52afe0 100644
--- a/arch/um/kernel/time_kern.c
+++ b/arch/um/kernel/time_kern.c
@@ -48,8 +48,6 @@ static unsigned long long prev_usecs;
 static long long delta;                 /* Deviation per interval */
 #endif
 
-#define MILLION 1000000
-
 void timer_irq(union uml_pt_regs *regs)
 {
         unsigned long long ticks = 0;
@@ -136,22 +134,6 @@ long um_stime(int __user *tptr)
         return 0;
 }
 
-void __udelay(unsigned long usecs)
-{
-        int i, n;
-
-        n = (loops_per_jiffy * HZ * usecs) / MILLION;
-        for(i=0;i<n;i++) ;
-}
-
-void __const_udelay(unsigned long usecs)
-{
-        int i, n;
-
-        n = (loops_per_jiffy * HZ * usecs) / MILLION;
-        for(i=0;i<n;i++) ;
-}
-
 void timer_handler(int sig, union uml_pt_regs *regs)
 {
         local_irq_disable();
diff --git a/arch/um/kernel/trap_kern.c b/arch/um/kernel/trap_kern.c
index 47e766e6ba10..1de22d8a313a 100644
--- a/arch/um/kernel/trap_kern.c
+++ b/arch/um/kernel/trap_kern.c
@@ -48,7 +48,7 @@ int handle_page_fault(unsigned long address, unsigned long ip,
                 goto good_area;
         else if(!(vma->vm_flags & VM_GROWSDOWN)) 
                 goto out;
-        else if(!ARCH_IS_STACKGROW(address))
+        else if(is_user && !ARCH_IS_STACKGROW(address))
                 goto out;
         else if(expand_stack(vma, address)) 
                 goto out;
@@ -57,10 +57,11 @@ int handle_page_fault(unsigned long address, unsigned long ip,
         *code_out = SEGV_ACCERR;
         if(is_write && !(vma->vm_flags & VM_WRITE)) 
                 goto out;
+
+        if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
+                goto out;
+
         page = address & PAGE_MASK;
-        pgd = pgd_offset(mm, page);
-        pud = pud_offset(pgd, page);
-        pmd = pmd_offset(pud, page);
         do {
  survive:
                 switch (handle_mm_fault(mm, vma, address, is_write)){
@@ -106,46 +107,24 @@ out_of_memory:
         goto out;
 }
 
-LIST_HEAD(physmem_remappers);
-
-void register_remapper(struct remapper *info)
-{
-        list_add(&info->list, &physmem_remappers);
-}
-
-static int check_remapped_addr(unsigned long address, int is_write)
-{
-        struct remapper *remapper;
-        struct list_head *ele;
-        __u64 offset;
-        int fd;
-
-        fd = phys_mapping(__pa(address), &offset);
-        if(fd == -1)
-                return(0);
-
-        list_for_each(ele, &physmem_remappers){
-                remapper = list_entry(ele, struct remapper, list);
-                if((*remapper->proc)(fd, address, is_write, offset))
-                        return(1);
-        }
-
-        return(0);
-}
-
-unsigned long segv(unsigned long address, unsigned long ip, int is_write, 
-                   int is_user, void *sc)
+/*
+ * We give a *copy* of the faultinfo in the regs to segv.
+ * This must be done, since nesting SEGVs could overwrite
+ * the info in the regs. A pointer to the info then would
+ * give us bad data!
+ */
+unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, void *sc)
 {
         struct siginfo si;
         void *catcher;
         int err;
+        int is_write = FAULT_WRITE(fi);
+        unsigned long address = FAULT_ADDRESS(fi);
 
         if(!is_user && (address >= start_vm) && (address < end_vm)){
                 flush_tlb_kernel_vm();
                 return(0);
         }
-        else if(check_remapped_addr(address & PAGE_MASK, is_write))
-                return(0);
         else if(current->mm == NULL)
                 panic("Segfault with no mm");
         err = handle_page_fault(address, ip, is_write, is_user, &si.si_code);
@@ -159,7 +138,7 @@ unsigned long segv(unsigned long address, unsigned long ip, int is_write,
         } 
         else if(current->thread.fault_addr != NULL)
                 panic("fault_addr set but no fault catcher");
-        else if(arch_fixup(ip, sc))
+        else if(!is_user && arch_fixup(ip, sc))
                 return(0);
 
         if(!is_user) 
@@ -171,6 +150,7 @@ unsigned long segv(unsigned long address, unsigned long ip, int is_write,
                 si.si_errno = 0;
                 si.si_code = BUS_ADRERR;
                 si.si_addr = (void *)address;
+                current->thread.arch.faultinfo = fi;
                 force_sig_info(SIGBUS, &si, current);
         }
         else if(err == -ENOMEM){
@@ -180,22 +160,20 @@ unsigned long segv(unsigned long address, unsigned long ip, int is_write,
         else {
                 si.si_signo = SIGSEGV;
                 si.si_addr = (void *) address;
-                current->thread.cr2 = address;
-                current->thread.err = is_write;
+                current->thread.arch.faultinfo = fi;
                 force_sig_info(SIGSEGV, &si, current);
         }
         return(0);
 }
 
-void bad_segv(unsigned long address, unsigned long ip, int is_write)
+void bad_segv(struct faultinfo fi, unsigned long ip)
 {
         struct siginfo si;
 
         si.si_signo = SIGSEGV;
         si.si_code = SEGV_ACCERR;
-        si.si_addr = (void *) address;
-        current->thread.cr2 = address;
-        current->thread.err = is_write;
+        si.si_addr = (void *) FAULT_ADDRESS(fi);
+        current->thread.arch.faultinfo = fi;
         force_sig_info(SIGSEGV, &si, current);
 }
 
@@ -204,6 +182,7 @@ void relay_signal(int sig, union uml_pt_regs *regs)
         if(arch_handle_signal(sig, regs)) return;
         if(!UPT_IS_USER(regs))
                 panic("Kernel mode signal %d", sig);
+        current->thread.arch.faultinfo = *UPT_FAULTINFO(regs);
         force_sig(sig, current);
 }
 
diff --git a/arch/um/kernel/trap_user.c b/arch/um/kernel/trap_user.c
index 50a4042a509f..f825a6eda3f5 100644
--- a/arch/um/kernel/trap_user.c
+++ b/arch/um/kernel/trap_user.c
@@ -54,23 +54,22 @@ struct {
 void segv_handler(int sig, union uml_pt_regs *regs)
 {
         int index, max;
+        struct faultinfo * fi = UPT_FAULTINFO(regs);
 
-        if(UPT_IS_USER(regs) && !UPT_SEGV_IS_FIXABLE(regs)){
-                bad_segv(UPT_FAULT_ADDR(regs), UPT_IP(regs), 
-                         UPT_FAULT_WRITE(regs));
+        if(UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)){
+                bad_segv(*fi, UPT_IP(regs));
                 return;
         }
         max = sizeof(segfault_record)/sizeof(segfault_record[0]);
         index = next_trap_index(max);
 
         nsegfaults++;
-        segfault_record[index].address = UPT_FAULT_ADDR(regs);
+        segfault_record[index].address = FAULT_ADDRESS(*fi);
         segfault_record[index].pid = os_getpid();
-        segfault_record[index].is_write = UPT_FAULT_WRITE(regs);
+        segfault_record[index].is_write = FAULT_WRITE(*fi);
         segfault_record[index].sp = UPT_SP(regs);
         segfault_record[index].is_user = UPT_IS_USER(regs);
-        segv(UPT_FAULT_ADDR(regs), UPT_IP(regs), UPT_FAULT_WRITE(regs),
-             UPT_IS_USER(regs), regs);
+        segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs);
 }
 
 void usr2_handler(int sig, union uml_pt_regs *regs)
diff --git a/arch/um/kernel/tt/Makefile b/arch/um/kernel/tt/Makefile
index 3d5177df3504..c3faea21a996 100644
--- a/arch/um/kernel/tt/Makefile
+++ b/arch/um/kernel/tt/Makefile
@@ -4,6 +4,7 @@
 #
 
 extra-y := unmap_fin.o
+targets := unmap.o
 clean-files := unmap_tmp.o
 
 obj-y = exec_kern.o exec_user.o gdb.o ksyms.o mem.o mem_user.o process_kern.o \
diff --git a/arch/um/kernel/tt/include/mode_kern-tt.h b/arch/um/kernel/tt/include/mode_kern-tt.h
index 28aaab3448fa..e0ca0e0b2516 100644
--- a/arch/um/kernel/tt/include/mode_kern-tt.h
+++ b/arch/um/kernel/tt/include/mode_kern-tt.h
@@ -19,7 +19,6 @@ extern int copy_thread_tt(int nr, unsigned long clone_flags, unsigned long sp,
                           unsigned long stack_top, struct task_struct *p,
                           struct pt_regs *regs);
 extern void release_thread_tt(struct task_struct *task);
-extern void exit_thread_tt(void);
 extern void initial_thread_cb_tt(void (*proc)(void *), void *arg);
 extern void init_idle_tt(void);
 extern void flush_tlb_kernel_range_tt(unsigned long start, unsigned long end);
diff --git a/arch/um/kernel/tt/include/uaccess-tt.h b/arch/um/kernel/tt/include/uaccess-tt.h
index bb69d6b7d022..3fbb5fe26f49 100644
--- a/arch/um/kernel/tt/include/uaccess-tt.h
+++ b/arch/um/kernel/tt/include/uaccess-tt.h
@@ -33,8 +33,8 @@ extern unsigned long uml_physmem;
          (((unsigned long) (addr) <= ((unsigned long) (addr) + (size))) && \
           (under_task_size(addr, size) || is_stack(addr, size))))
 
-static inline int __deprecated verify_area_tt(int type, const void * addr,
-                                 unsigned long size)
+static inline int verify_area_tt(int type, const void * addr,
+                                 unsigned long size)
 {
         return(access_ok_tt(type, addr, size) ? 0 : -EFAULT);
 }
diff --git a/arch/um/kernel/tt/ksyms.c b/arch/um/kernel/tt/ksyms.c
index 92ec85d67c7c..84a9385a8fef 100644
--- a/arch/um/kernel/tt/ksyms.c
+++ b/arch/um/kernel/tt/ksyms.c
@@ -12,6 +12,7 @@ EXPORT_SYMBOL(__do_copy_to_user);
 EXPORT_SYMBOL(__do_strncpy_from_user);
 EXPORT_SYMBOL(__do_strnlen_user); 
 EXPORT_SYMBOL(__do_clear_user);
+EXPORT_SYMBOL(clear_user_tt);
 
 EXPORT_SYMBOL(tracing_pid);
 EXPORT_SYMBOL(honeypot);
diff --git a/arch/um/kernel/tt/mem.c b/arch/um/kernel/tt/mem.c
index 74346a04a2b2..bcb8796c3cb1 100644
--- a/arch/um/kernel/tt/mem.c
+++ b/arch/um/kernel/tt/mem.c
@@ -21,14 +21,8 @@ void before_mem_tt(unsigned long brk_start)
         remap_data(UML_ROUND_DOWN(&__bss_start), UML_ROUND_UP(&_end), 1);
 }
 
-#ifdef CONFIG_HOST_2G_2G
-#define TOP 0x80000000
-#else
-#define TOP 0xc0000000
-#endif
-
 #define SIZE ((CONFIG_NEST_LEVEL + CONFIG_KERNEL_HALF_GIGS) * 0x20000000)
-#define START (TOP - SIZE)
+#define START (CONFIG_TOP_ADDR - SIZE)
 
 unsigned long set_task_sizes_tt(int arg, unsigned long *host_size_out, 
                                 unsigned long *task_size_out)
diff --git a/arch/um/kernel/tt/process_kern.c b/arch/um/kernel/tt/process_kern.c
index f19f7c18febe..df810ca8fc12 100644
--- a/arch/um/kernel/tt/process_kern.c
+++ b/arch/um/kernel/tt/process_kern.c
@@ -65,8 +65,7 @@ void *switch_to_tt(void *prev, void *next, void *last)
                 panic("write of switch_pipe failed, err = %d", -err);
 
         reading = 1;
-        if((from->exit_state == EXIT_ZOMBIE) ||
-           (from->exit_state == EXIT_DEAD))
+        if(from->thread.mode.tt.switch_pipe[0] == -1)
                 os_kill_process(os_getpid(), 0);
 
         err = os_read_file(from->thread.mode.tt.switch_pipe[0], &c, sizeof(c));
@@ -81,8 +80,7 @@ void *switch_to_tt(void *prev, void *next, void *last)
          * in case it has not already killed itself.
          */
         prev_sched = current->thread.prev_sched;
-        if((prev_sched->exit_state == EXIT_ZOMBIE) ||
-           (prev_sched->exit_state == EXIT_DEAD))
+        if(prev_sched->thread.mode.tt.switch_pipe[0] == -1)
                 os_kill_process(prev_sched->thread.mode.tt.extern_pid, 1);
 
         change_sig(SIGVTALRM, vtalrm);
@@ -101,14 +99,18 @@ void release_thread_tt(struct task_struct *task)
 {
         int pid = task->thread.mode.tt.extern_pid;
 
+        /*
+         * We first have to kill the other process, before
+         * closing its switch_pipe. Else it might wake up
+         * and receive "EOF" before we could kill it.
+         */
         if(os_getpid() != pid)
                 os_kill_process(pid, 0);
-}
 
-void exit_thread_tt(void)
-{
-        os_close_file(current->thread.mode.tt.switch_pipe[0]);
-        os_close_file(current->thread.mode.tt.switch_pipe[1]);
+        os_close_file(task->thread.mode.tt.switch_pipe[0]);
+        os_close_file(task->thread.mode.tt.switch_pipe[1]);
+        /* use switch_pipe as flag: thread is released */
+        task->thread.mode.tt.switch_pipe[0] = -1;
 }
 
 void suspend_new_thread(int fd)
diff --git a/arch/um/kernel/tt/syscall_user.c b/arch/um/kernel/tt/syscall_user.c
index e4e7e9c2224c..b218316cfdb2 100644
--- a/arch/um/kernel/tt/syscall_user.c
+++ b/arch/um/kernel/tt/syscall_user.c
@@ -63,6 +63,10 @@ void do_syscall(void *task, int pid, int local_using_sysemu)
 
         UPT_SYSCALL_NR(TASK_REGS(task)) = PT_SYSCALL_NR(proc_regs);
 
+#ifdef UPT_ORIGGPR2
+        UPT_ORIGGPR2(TASK_REGS(task)) = REGS_ORIGGPR2(proc_regs);
+#endif
+
         if(((unsigned long *) PT_IP(proc_regs) >= &_stext) &&
            ((unsigned long *) PT_IP(proc_regs) <= &_etext))
                 tracer_panic("I'm tracing myself and I can't get out");
diff --git a/arch/um/kernel/tt/tracer.c b/arch/um/kernel/tt/tracer.c
index 7b5d937e5955..d11e7399d7a1 100644
--- a/arch/um/kernel/tt/tracer.c
+++ b/arch/um/kernel/tt/tracer.c
@@ -26,6 +26,7 @@
 #include "kern_util.h"
 #include "chan_user.h"
 #include "ptrace_user.h"
+#include "irq_user.h"
 #include "mode.h"
 #include "tt.h"
 
@@ -33,7 +34,7 @@ static int tracer_winch[2];
 
 int is_tracer_winch(int pid, int fd, void *data)
 {
-        if(pid != tracing_pid)
+        if(pid != os_getpgrp())
                 return(0);
 
         register_winch_irq(tracer_winch[0], fd, -1, data);
@@ -89,8 +90,10 @@ void tracer_panic(char *format, ...)
 
 static void tracer_segv(int sig, struct sigcontext sc)
 {
+        struct faultinfo fi;
+        GET_FAULTINFO_FROM_SC(fi, &sc);
         printf("Tracing thread segfault at address 0x%lx, ip 0x%lx\n",
-               SC_FAULT_ADDR(&sc), SC_IP(&sc));
+               FAULT_ADDRESS(fi), SC_IP(&sc));
         while(1)
                 pause();
 }
@@ -117,6 +120,7 @@ static int signal_tramp(void *arg)
         signal(SIGSEGV, (__sighandler_t) sig_handler);
         set_cmdline("(idle thread)");
         set_init_pid(os_getpid());
+        init_irq_signals(0);
         proc = arg;
         return((*proc)(NULL));
 }
diff --git a/arch/um/kernel/tt/trap_user.c b/arch/um/kernel/tt/trap_user.c
index 92a3820ca543..fc108615beaf 100644
--- a/arch/um/kernel/tt/trap_user.c
+++ b/arch/um/kernel/tt/trap_user.c
@@ -7,6 +7,7 @@
 #include <errno.h>
 #include <signal.h>
 #include "sysdep/ptrace.h"
+#include "sysdep/sigcontext.h"
 #include "signal_user.h"
 #include "user_util.h"
 #include "kern_util.h"
@@ -28,6 +29,11 @@ void sig_handler_common_tt(int sig, void *sc_ptr)
                 change_sig(SIGSEGV, 1);
 
         r = &TASK_REGS(get_current())->tt;
+        if ( sig == SIGFPE || sig == SIGSEGV ||
+             sig == SIGBUS || sig == SIGILL ||
+             sig == SIGTRAP ) {
+                GET_FAULTINFO_FROM_SC(r->faultinfo, sc);
+        }
         save_regs = *r;
         is_user = user_context(SC_SP(sc));
         r->sc = sc;
diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
index 5c49d88eed3d..4d10ec372a67 100644
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -23,6 +23,7 @@
 #include "asm/ptrace.h"
 #include "asm/elf.h"
 #include "asm/user.h"
+#include "asm/setup.h"
 #include "ubd_user.h"
 #include "asm/current.h"
 #include "asm/setup.h"
@@ -42,9 +43,9 @@
 #define DEFAULT_COMMAND_LINE "root=98:0"
 
 /* Changed in linux_main and setup_arch, which run before SMP is started */
-char command_line[COMMAND_LINE_SIZE] = { 0 };
+static char command_line[COMMAND_LINE_SIZE] = { 0 };
 
-void add_arg(char *arg)
+static void add_arg(char *arg)
 {
         if (strlen(command_line) + strlen(arg) + 1 > COMMAND_LINE_SIZE) {
                 printf("add_arg: Too many command line arguments!\n");
@@ -449,7 +450,7 @@ void __init setup_arch(char **cmdline_p)
 {
         notifier_chain_register(&panic_notifier_list, &panic_exit_notifier);
         paging_init();
-        strlcpy(saved_command_line, command_line, COMMAND_LINE_SIZE);
+        strlcpy(saved_command_line, command_line, COMMAND_LINE_SIZE);
         *cmdline_p = command_line;
         setup_hostinfo();
 }
diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
index 76eadb309189..dd5355500bdc 100644
--- a/arch/um/kernel/uml.lds.S
+++ b/arch/um/kernel/uml.lds.S
@@ -73,6 +73,8 @@ SECTIONS
 
   .got           : { *(.got.plt) *(.got) }
   .dynamic       : { *(.dynamic) }
+  .tdata          : { *(.tdata .tdata.* .gnu.linkonce.td.*) }
+  .tbss           : { *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon) }
   /* We want the small data sections together, so single-instruction offsets
      can access them all, and initialized data all before uninitialized, so
      we can shorten the on-disk segment size.  */
diff --git a/arch/um/kernel/vmlinux.lds.S b/arch/um/kernel/vmlinux.lds.S
new file mode 100644
index 000000000000..1660a769674b
--- /dev/null
+++ b/arch/um/kernel/vmlinux.lds.S
@@ -0,0 +1,6 @@
+#include <linux/config.h>
+#ifdef CONFIG_LD_SCRIPT_STATIC
+#include "uml.lds.S"
+#else
+#include "dyn.lds.S"
+#endif
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index ba9ca1cc790a..1e126bfd31a7 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -123,6 +123,11 @@ int os_getpid(void)
         return(getpid());
 }
 
+int os_getpgrp(void)
+{
+        return getpgrp();
+}
+
 int os_map_memory(void *virt, int fd, unsigned long long off, unsigned long len,
                   int r, int w, int x)
 {
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index 7eac1baf5975..c7bfd5ee3925 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -8,7 +8,7 @@
 #include "mode.h"
 #include "sysdep/signal.h"
 
-void sig_handler(int sig)
+void sig_handler(ARCH_SIGHDLR_PARAM)
 {
         struct sigcontext *sc;
 
@@ -19,7 +19,7 @@ void sig_handler(int sig)
 
 extern int timer_irq_inited;
 
-void alarm_handler(int sig)
+void alarm_handler(ARCH_SIGHDLR_PARAM)
 {
         struct sigcontext *sc;
 
diff --git a/arch/um/os-Linux/util/Makefile b/arch/um/os-Linux/util/Makefile
index fb00ddf969bd..9778aed0c314 100644
--- a/arch/um/os-Linux/util/Makefile
+++ b/arch/um/os-Linux/util/Makefile
@@ -1,4 +1,4 @@
 hostprogs-y             := mk_user_constants
 always                  := $(hostprogs-y)
 
-mk_user_constants-objs  := mk_user_constants.o
+HOSTCFLAGS_mk_user_constants.o := -I$(objtree)/arch/um
diff --git a/arch/um/os-Linux/util/mk_user_constants.c b/arch/um/os-Linux/util/mk_user_constants.c
index 0933518aa8bd..4838f30eecf0 100644
--- a/arch/um/os-Linux/util/mk_user_constants.c
+++ b/arch/um/os-Linux/util/mk_user_constants.c
@@ -1,11 +1,5 @@
 #include <stdio.h>
-#include <asm/types.h>
-/* For some reason, x86_64 nowhere defines u64 and u32, even though they're
- * used throughout the headers.
- */
-typedef __u64 u64;
-typedef __u32 u32;
-#include <asm/user.h>
+#include <user-offsets.h>
 
 int main(int argc, char **argv)
 {
@@ -20,7 +14,7 @@ int main(int argc, char **argv)
    * x86_64 (216 vs 168 bytes).  user_regs_struct is the correct size on
    * both x86_64 and i386.
    */
-  printf("#define UM_FRAME_SIZE %d\n", (int) sizeof(struct user_regs_struct));
+  printf("#define UM_FRAME_SIZE %d\n", __UM_FRAME_SIZE);
 
   printf("\n");
   printf("#endif\n");
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index 143f6fea0763..0b2491883d9c 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -2,12 +2,27 @@
 # arch/um: Generic definitions
 # ===========================================================================
 
-USER_SINGLE_OBJS = $(foreach f,$(patsubst %.o,%,$(obj-y) $(obj-m)),$($(f)-objs))
-USER_OBJS += $(filter %_user.o,$(obj-y) $(obj-m) $(USER_SINGLE_OBJS))
-
+USER_SINGLE_OBJS := \
+        $(foreach f,$(patsubst %.o,%,$(obj-y) $(obj-m)),$($(f)-objs))
+USER_OBJS += $(filter %_user.o,$(obj-y) $(obj-m)  $(USER_SINGLE_OBJS))
 USER_OBJS := $(foreach file,$(USER_OBJS),$(obj)/$(file))
 
-$(USER_OBJS): c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) $(CFLAGS_$(notdir $@))
+$(USER_OBJS) : c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) \
+        $(CFLAGS_$(notdir $@))
 
 quiet_cmd_make_link = SYMLINK $@
-cmd_make_link       = rm -f $@; ln -sf $(srctree)/arch/$(SUBARCH)/$($(notdir $@)-dir)/$(notdir $@) $@
+cmd_make_link       = ln -sf $(srctree)/arch/$(SUBARCH)/$($(notdir $@)-dir)/$(notdir $@) $@
+
+# this needs to be before the foreach, because targets does not accept
+# complete paths like $(obj)/$(f). To make sure this works, use a := assignment,
+# or we will get $(obj)/$(f) in the "targets" value.
+# Also, this forces you to use the := syntax when assigning to targets.
+# Otherwise the line below will cause an infinite loop (if you don't know why,
+# just do it).
+
+targets := $(targets) $(SYMLINKS)
+
+SYMLINKS := $(foreach f,$(SYMLINKS),$(obj)/$(f))
+
+$(SYMLINKS): FORCE
+        $(call if_changed,make_link)
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 950781e354de..4351e5605506 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -7,24 +7,13 @@ obj-$(CONFIG_MODULES) += module.o
 
 USER_OBJS := bugs.o ptrace_user.o sigcontext.o fault.o
 
-include arch/um/scripts/Makefile.rules
-
 SYMLINKS = bitops.c semaphore.c highmem.c module.c
 
-# this needs to be before the foreach, because clean-files does not accept
-# complete paths like $(src)/$f.
-clean-files := $(SYMLINKS)
-
-targets += $(SYMLINKS)
-
-SYMLINKS := $(foreach f,$(SYMLINKS),$(obj)/$f)
+include arch/um/scripts/Makefile.rules
 
 bitops.c-dir = lib
 semaphore.c-dir = kernel
 highmem.c-dir = mm
 module.c-dir = kernel
 
-$(SYMLINKS): FORCE
-        $(call if_changed,make_link)
-
 subdir- := util
diff --git a/arch/um/sys-i386/checksum.S b/arch/um/sys-i386/checksum.S
index a11171fb6223..d98b2fff3d08 100644
--- a/arch/um/sys-i386/checksum.S
+++ b/arch/um/sys-i386/checksum.S
@@ -38,7 +38,7 @@ unsigned int csum_partial(const unsigned char * buff, int len, unsigned int sum)
                 
 .text
 .align 4
-.globl arch_csum_partial                                                                
+.globl csum_partial
                 
 #ifndef CONFIG_X86_USE_PPRO_CHECKSUM
 
@@ -49,7 +49,7 @@ unsigned int csum_partial(const unsigned char * buff, int len, unsigned int sum)
            * Fortunately, it is easy to convert 2-byte alignment to 4-byte
            * alignment for the unrolled loop.
            */           
-arch_csum_partial:      
+csum_partial:
         pushl %esi
         pushl %ebx
         movl 20(%esp),%eax      # Function arg: unsigned int sum
@@ -119,7 +119,7 @@ arch_csum_partial:
 
 /* Version for PentiumII/PPro */
 
-arch_csum_partial:
+csum_partial:
         pushl %esi
         pushl %ebx
         movl 20(%esp),%eax      # Function arg: unsigned int sum
diff --git a/arch/um/sys-i386/delay.c b/arch/um/sys-i386/delay.c
index 20d37dbbaf08..2c11b9770e8b 100644
--- a/arch/um/sys-i386/delay.c
+++ b/arch/um/sys-i386/delay.c
@@ -1,3 +1,8 @@
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <asm/param.h>
+
 void __delay(unsigned long time)
 {
         /* Stolen from the i386 __loop_delay */
@@ -12,3 +17,24 @@ void __delay(unsigned long time)
                 :"0" (time));
 }
 
+void __udelay(unsigned long usecs)
+{
+        int i, n;
+
+        n = (loops_per_jiffy * HZ * usecs) / MILLION;
+        for(i=0;i<n;i++)
+                cpu_relax();
+}
+
+EXPORT_SYMBOL(__udelay);
+
+void __const_udelay(unsigned long usecs)
+{
+        int i, n;
+
+        n = (loops_per_jiffy * HZ * usecs) / MILLION;
+        for(i=0;i<n;i++)
+                cpu_relax();
+}
+
+EXPORT_SYMBOL(__const_udelay);
diff --git a/arch/um/sys-i386/kernel-offsets.c b/arch/um/sys-i386/kernel-offsets.c
new file mode 100644
index 000000000000..9f8ecd1fdd96
--- /dev/null
+++ b/arch/um/sys-i386/kernel-offsets.c
@@ -0,0 +1,25 @@
+#include <linux/config.h>
+#include <linux/stddef.h>
+#include <linux/sched.h>
+#include <linux/time.h>
+#include <asm/page.h>
+
+#define DEFINE(sym, val) \
+        asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+
+#define STR(x) #x
+#define DEFINE_STR(sym, val) asm volatile("\n->" #sym " " STR(val) " " #val: : )
+
+#define BLANK() asm volatile("\n->" : : )
+
+#define OFFSET(sym, str, mem) \
+        DEFINE(sym, offsetof(struct str, mem));
+
+void foo(void)
+{
+        OFFSET(TASK_DEBUGREGS, task_struct, thread.arch.debugregs);
+#ifdef CONFIG_MODE_TT
+        OFFSET(TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
+#endif
+#include <common-offsets.h>
+}
diff --git a/arch/um/sys-i386/ksyms.c b/arch/um/sys-i386/ksyms.c
index 74f70a120458..db524ab3f743 100644
--- a/arch/um/sys-i386/ksyms.c
+++ b/arch/um/sys-i386/ksyms.c
@@ -2,6 +2,7 @@
 #include "linux/in6.h"
 #include "linux/rwsem.h"
 #include "asm/byteorder.h"
+#include "asm/delay.h"
 #include "asm/semaphore.h"
 #include "asm/uaccess.h"
 #include "asm/checksum.h"
@@ -13,5 +14,8 @@ EXPORT_SYMBOL(__down_failed_trylock);
 EXPORT_SYMBOL(__up_wakeup);
 
 /* Networking helper routines. */
-EXPORT_SYMBOL(csum_partial_copy_from);
-EXPORT_SYMBOL(csum_partial_copy_to);
+EXPORT_SYMBOL(csum_partial);
+
+/* delay core functions */
+EXPORT_SYMBOL(__const_udelay);
+EXPORT_SYMBOL(__udelay);
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index 31bcb2f997d4..dc755b0b9db8 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -25,7 +25,7 @@ int sys_modify_ldt_tt(int func, void __user *ptr, unsigned long bytecount)
 #endif
 
 #ifdef CONFIG_MODE_SKAS
-extern int userspace_pid;
+extern int userspace_pid[];
 
 #include "skas_ptrace.h"
 
@@ -56,7 +56,8 @@ int sys_modify_ldt_skas(int func, void __user *ptr, unsigned long bytecount)
         ldt = ((struct ptrace_ldt) { .func      = func,
                                      .ptr       = buf,
                                      .bytecount = bytecount });
-        res = ptrace(PTRACE_LDT, userspace_pid, 0, (unsigned long) &ldt);
+#warning Need to look up userspace_pid by cpu
+        res = ptrace(PTRACE_LDT, userspace_pid[0], 0, (unsigned long) &ldt);
         if(res < 0)
                 goto out;
 
diff --git a/arch/um/sys-i386/ptrace.c b/arch/um/sys-i386/ptrace.c
index e470d28cdf84..e839ce65ad28 100644
--- a/arch/um/sys-i386/ptrace.c
+++ b/arch/um/sys-i386/ptrace.c
@@ -73,6 +73,25 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         return 0;
 }
 
+int poke_user(struct task_struct *child, long addr, long data)
+{
+        if ((addr & 3) || addr < 0)
+                return -EIO;
+
+        if (addr < MAX_REG_OFFSET)
+                return putreg(child, addr, data);
+
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                addr -= offsetof(struct user, u_debugreg[0]);
+                addr = addr >> 2;
+                if((addr == 4) || (addr == 5)) return -EIO;
+                child->thread.arch.debugregs[addr] = data;
+                return 0;
+        }
+        return -EIO;
+}
+
 unsigned long getreg(struct task_struct *child, int regno)
 {
         unsigned long retval = ~0UL;
@@ -93,6 +112,27 @@ unsigned long getreg(struct task_struct *child, int regno)
         return retval;
 }
 
+int peek_user(struct task_struct *child, long addr, long data)
+{
+/* read the word at location addr in the USER area. */
+        unsigned long tmp;
+
+        if ((addr & 3) || addr < 0)
+                return -EIO;
+
+        tmp = 0;  /* Default return condition */
+        if(addr < MAX_REG_OFFSET){
+                tmp = getreg(child, addr);
+        }
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                addr -= offsetof(struct user, u_debugreg[0]);
+                addr = addr >> 2;
+                tmp = child->thread.arch.debugregs[addr];
+        }
+        return put_user(tmp, (unsigned long *) data);
+}
+
 struct i387_fxsave_struct {
         unsigned short  cwd;
         unsigned short  swd;
diff --git a/arch/um/sys-i386/signal.c b/arch/um/sys-i386/signal.c
index 76ba87254b25..03913ca5d256 100644
--- a/arch/um/sys-i386/signal.c
+++ b/arch/um/sys-i386/signal.c
@@ -47,9 +47,6 @@ static int copy_sc_from_user_skas(struct pt_regs *regs,
         REGS_CS(regs->regs.skas.regs) = sc.cs;
         REGS_EFLAGS(regs->regs.skas.regs) = sc.eflags;
         REGS_SS(regs->regs.skas.regs) = sc.ss;
-        regs->regs.skas.fault_addr = sc.cr2;
-        regs->regs.skas.fault_type = FAULT_WRITE(sc.err);
-        regs->regs.skas.trap_type = sc.trapno;
 
         err = restore_fp_registers(userspace_pid[0], fpregs);
         if(err < 0){
@@ -62,11 +59,11 @@ static int copy_sc_from_user_skas(struct pt_regs *regs,
 }
 
 int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
-                         struct pt_regs *regs, unsigned long fault_addr,
-                         int fault_type)
+                         struct pt_regs *regs)
 {
         struct sigcontext sc;
         unsigned long fpregs[HOST_FP_SIZE];
+        struct faultinfo * fi = &current->thread.arch.faultinfo;
         int err;
 
         sc.gs = REGS_GS(regs->regs.skas.regs);
@@ -86,9 +83,9 @@ int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
         sc.eflags = REGS_EFLAGS(regs->regs.skas.regs);
         sc.esp_at_signal = regs->regs.skas.regs[UESP];
         sc.ss = regs->regs.skas.regs[SS];
-        sc.cr2 = fault_addr;
-        sc.err = TO_SC_ERR(fault_type);
-        sc.trapno = regs->regs.skas.trap_type;
+        sc.cr2 = fi->cr2;
+        sc.err = fi->error_code;
+        sc.trapno = fi->trap_no;
 
         err = save_fp_registers(userspace_pid[0], fpregs);
         if(err < 0){
@@ -167,9 +164,7 @@ static int copy_sc_to_user(struct sigcontext *to, struct _fpstate *fp,
 {
         return(CHOOSE_MODE(copy_sc_to_user_tt(to, fp, UPT_SC(&from->regs),
                                               sizeof(*fp)),
-                           copy_sc_to_user_skas(to, fp, from,
-                                                current->thread.cr2,
-                                                current->thread.err)));
+                           copy_sc_to_user_skas(to, fp, from)));
 }
 
 static int copy_ucontext_to_user(struct ucontext *uc, struct _fpstate *fp,
diff --git a/arch/um/sys-i386/user-offsets.c b/arch/um/sys-i386/user-offsets.c
new file mode 100644
index 000000000000..3ceaabceb3d7
--- /dev/null
+++ b/arch/um/sys-i386/user-offsets.c
@@ -0,0 +1,69 @@
+#include <stdio.h>
+#include <signal.h>
+#include <asm/ptrace.h>
+#include <asm/user.h>
+#include <linux/stddef.h>
+
+#define DEFINE(sym, val) \
+        asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+
+#define OFFSET(sym, str, mem) \
+        DEFINE(sym, offsetof(struct str, mem));
+
+void foo(void)
+{
+        OFFSET(SC_IP, sigcontext, eip);
+        OFFSET(SC_SP, sigcontext, esp);
+        OFFSET(SC_FS, sigcontext, fs);
+        OFFSET(SC_GS, sigcontext, gs);
+        OFFSET(SC_DS, sigcontext, ds);
+        OFFSET(SC_ES, sigcontext, es);
+        OFFSET(SC_SS, sigcontext, ss);
+        OFFSET(SC_CS, sigcontext, cs);
+        OFFSET(SC_EFLAGS, sigcontext, eflags);
+        OFFSET(SC_EAX, sigcontext, eax);
+        OFFSET(SC_EBX, sigcontext, ebx);
+        OFFSET(SC_ECX, sigcontext, ecx);
+        OFFSET(SC_EDX, sigcontext, edx);
+        OFFSET(SC_EDI, sigcontext, edi);
+        OFFSET(SC_ESI, sigcontext, esi);
+        OFFSET(SC_EBP, sigcontext, ebp);
+        OFFSET(SC_TRAPNO, sigcontext, trapno);
+        OFFSET(SC_ERR, sigcontext, err);
+        OFFSET(SC_CR2, sigcontext, cr2);
+        OFFSET(SC_FPSTATE, sigcontext, fpstate);
+        OFFSET(SC_SIGMASK, sigcontext, oldmask);
+        OFFSET(SC_FP_CW, _fpstate, cw);
+        OFFSET(SC_FP_SW, _fpstate, sw);
+        OFFSET(SC_FP_TAG, _fpstate, tag);
+        OFFSET(SC_FP_IPOFF, _fpstate, ipoff);
+        OFFSET(SC_FP_CSSEL, _fpstate, cssel);
+        OFFSET(SC_FP_DATAOFF, _fpstate, dataoff);
+        OFFSET(SC_FP_DATASEL, _fpstate, datasel);
+        OFFSET(SC_FP_ST, _fpstate, _st);
+        OFFSET(SC_FXSR_ENV, _fpstate, _fxsr_env);
+
+        DEFINE(HOST_FRAME_SIZE, FRAME_SIZE);
+        DEFINE(HOST_FP_SIZE,
+                sizeof(struct user_i387_struct) / sizeof(unsigned long));
+        DEFINE(HOST_XFP_SIZE,
+               sizeof(struct user_fxsr_struct) / sizeof(unsigned long));
+
+        DEFINE(HOST_IP, EIP);
+        DEFINE(HOST_SP, UESP);
+        DEFINE(HOST_EFLAGS, EFL);
+        DEFINE(HOST_EAX, EAX);
+        DEFINE(HOST_EBX, EBX);
+        DEFINE(HOST_ECX, ECX);
+        DEFINE(HOST_EDX, EDX);
+        DEFINE(HOST_ESI, ESI);
+        DEFINE(HOST_EDI, EDI);
+        DEFINE(HOST_EBP, EBP);
+        DEFINE(HOST_CS, CS);
+        DEFINE(HOST_SS, SS);
+        DEFINE(HOST_DS, DS);
+        DEFINE(HOST_FS, FS);
+        DEFINE(HOST_ES, ES);
+        DEFINE(HOST_GS, GS);
+        DEFINE(__UM_FRAME_SIZE, sizeof(struct user_regs_struct));
+}
diff --git a/arch/um/sys-i386/util/Makefile b/arch/um/sys-i386/util/Makefile
index 34860f9ca7b0..bf61afd0b045 100644
--- a/arch/um/sys-i386/util/Makefile
+++ b/arch/um/sys-i386/util/Makefile
@@ -1,8 +1,5 @@
-
 hostprogs-y     := mk_sc mk_thread
 always          := $(hostprogs-y)
 
-mk_thread-objs  := mk_thread_kern.o mk_thread_user.o
-
-HOSTCFLAGS_mk_thread_kern.o     := $(CFLAGS) $(CPPFLAGS)
-HOSTCFLAGS_mk_thread_user.o     := $(USER_CFLAGS)
+HOSTCFLAGS_mk_sc.o := -I$(objtree)/arch/um
+HOSTCFLAGS_mk_thread.o := -I$(objtree)/arch/um
diff --git a/arch/um/sys-i386/util/mk_sc.c b/arch/um/sys-i386/util/mk_sc.c
index 85cbd30396f7..04c0d73433aa 100644
--- a/arch/um/sys-i386/util/mk_sc.c
+++ b/arch/um/sys-i386/util/mk_sc.c
@@ -1,52 +1,51 @@
 #include <stdio.h>
-#include <signal.h>
-#include <linux/stddef.h>
+#include <user-offsets.h>
 
 #define SC_OFFSET(name, field) \
-  printf("#define " name "(sc) *((unsigned long *) &(((char *) (sc))[%d]))\n",\
-         offsetof(struct sigcontext, field))
+  printf("#define " #name "(sc) *((unsigned long *) &(((char *) (sc))[%d]))\n",\
+         name)
 
 #define SC_FP_OFFSET(name, field) \
-  printf("#define " name \
+  printf("#define " #name \
          "(sc) *((unsigned long *) &(((char *) (SC_FPSTATE(sc)))[%d]))\n",\
-         offsetof(struct _fpstate, field))
+         name)
 
 #define SC_FP_OFFSET_PTR(name, field, type) \
-  printf("#define " name \
+  printf("#define " #name \
          "(sc) ((" type " *) &(((char *) (SC_FPSTATE(sc)))[%d]))\n",\
-         offsetof(struct _fpstate, field))
+         name)
 
 int main(int argc, char **argv)
 {
-  SC_OFFSET("SC_IP", eip);
-  SC_OFFSET("SC_SP", esp);
-  SC_OFFSET("SC_FS", fs);
-  SC_OFFSET("SC_GS", gs);
-  SC_OFFSET("SC_DS", ds);
-  SC_OFFSET("SC_ES", es);
-  SC_OFFSET("SC_SS", ss);
-  SC_OFFSET("SC_CS", cs);
-  SC_OFFSET("SC_EFLAGS", eflags);
-  SC_OFFSET("SC_EAX", eax);
-  SC_OFFSET("SC_EBX", ebx);
-  SC_OFFSET("SC_ECX", ecx);
-  SC_OFFSET("SC_EDX", edx);
-  SC_OFFSET("SC_EDI", edi);
-  SC_OFFSET("SC_ESI", esi);
-  SC_OFFSET("SC_EBP", ebp);
-  SC_OFFSET("SC_TRAPNO", trapno);
-  SC_OFFSET("SC_ERR", err);
-  SC_OFFSET("SC_CR2", cr2);
-  SC_OFFSET("SC_FPSTATE", fpstate);
-  SC_OFFSET("SC_SIGMASK", oldmask);
-  SC_FP_OFFSET("SC_FP_CW", cw);
-  SC_FP_OFFSET("SC_FP_SW", sw);
-  SC_FP_OFFSET("SC_FP_TAG", tag);
-  SC_FP_OFFSET("SC_FP_IPOFF", ipoff);
-  SC_FP_OFFSET("SC_FP_CSSEL", cssel);
-  SC_FP_OFFSET("SC_FP_DATAOFF", dataoff);
-  SC_FP_OFFSET("SC_FP_DATASEL", datasel);
-  SC_FP_OFFSET_PTR("SC_FP_ST", _st, "struct _fpstate");
-  SC_FP_OFFSET_PTR("SC_FXSR_ENV", _fxsr_env, "void");
+  SC_OFFSET(SC_IP, eip);
+  SC_OFFSET(SC_SP, esp);
+  SC_OFFSET(SC_FS, fs);
+  SC_OFFSET(SC_GS, gs);
+  SC_OFFSET(SC_DS, ds);
+  SC_OFFSET(SC_ES, es);
+  SC_OFFSET(SC_SS, ss);
+  SC_OFFSET(SC_CS, cs);
+  SC_OFFSET(SC_EFLAGS, eflags);
+  SC_OFFSET(SC_EAX, eax);
+  SC_OFFSET(SC_EBX, ebx);
+  SC_OFFSET(SC_ECX, ecx);
+  SC_OFFSET(SC_EDX, edx);
+  SC_OFFSET(SC_EDI, edi);
+  SC_OFFSET(SC_ESI, esi);
+  SC_OFFSET(SC_EBP, ebp);
+  SC_OFFSET(SC_TRAPNO, trapno);
+  SC_OFFSET(SC_ERR, err);
+  SC_OFFSET(SC_CR2, cr2);
+  SC_OFFSET(SC_FPSTATE, fpstate);
+  SC_OFFSET(SC_SIGMASK, oldmask);
+  SC_FP_OFFSET(SC_FP_CW, cw);
+  SC_FP_OFFSET(SC_FP_SW, sw);
+  SC_FP_OFFSET(SC_FP_TAG, tag);
+  SC_FP_OFFSET(SC_FP_IPOFF, ipoff);
+  SC_FP_OFFSET(SC_FP_CSSEL, cssel);
+  SC_FP_OFFSET(SC_FP_DATAOFF, dataoff);
+  SC_FP_OFFSET(SC_FP_DATASEL, datasel);
+  SC_FP_OFFSET_PTR(SC_FP_ST, _st, "struct _fpstate");
+  SC_FP_OFFSET_PTR(SC_FXSR_ENV, _fxsr_env, "void");
   return(0);
 }
diff --git a/arch/um/sys-i386/util/mk_thread.c b/arch/um/sys-i386/util/mk_thread.c
new file mode 100644
index 000000000000..7470d0dda67e
--- /dev/null
+++ b/arch/um/sys-i386/util/mk_thread.c
@@ -0,0 +1,22 @@
+#include <stdio.h>
+#include <kernel-offsets.h>
+
+int main(int argc, char **argv)
+{
+  printf("/*\n");
+  printf(" * Generated by mk_thread\n");
+  printf(" */\n");
+  printf("\n");
+  printf("#ifndef __UM_THREAD_H\n");
+  printf("#define __UM_THREAD_H\n");
+  printf("\n");
+  printf("#define TASK_DEBUGREGS(task) ((unsigned long *) "
+         "&(((char *) (task))[%d]))\n", TASK_DEBUGREGS);
+#ifdef TASK_EXTERN_PID
+  printf("#define TASK_EXTERN_PID(task) *((int *) &(((char *) (task))[%d]))\n",
+         TASK_EXTERN_PID);
+#endif
+  printf("\n");
+  printf("#endif\n");
+  return(0);
+}
diff --git a/arch/um/sys-i386/util/mk_thread_kern.c b/arch/um/sys-i386/util/mk_thread_kern.c
deleted file mode 100644
index 948b1ce85230..000000000000
--- a/arch/um/sys-i386/util/mk_thread_kern.c
+++ /dev/null
@@ -1,22 +0,0 @@
-#include "linux/config.h"
-#include "linux/stddef.h"
-#include "linux/sched.h"
-
-extern void print_head(void);
-extern void print_constant_ptr(char *name, int value);
-extern void print_constant(char *name, char *type, int value);
-extern void print_tail(void);
-
-#define THREAD_OFFSET(field) offsetof(struct task_struct, thread.field)
-
-int main(int argc, char **argv)
-{
-  print_head();
-  print_constant_ptr("TASK_DEBUGREGS", THREAD_OFFSET(arch.debugregs));
-#ifdef CONFIG_MODE_TT
-  print_constant("TASK_EXTERN_PID", "int", THREAD_OFFSET(mode.tt.extern_pid));
-#endif
-  print_tail();
-  return(0);
-}
-
diff --git a/arch/um/sys-i386/util/mk_thread_user.c b/arch/um/sys-i386/util/mk_thread_user.c
deleted file mode 100644
index 2620cd6aa1f1..000000000000
--- a/arch/um/sys-i386/util/mk_thread_user.c
+++ /dev/null
@@ -1,30 +0,0 @@
-#include <stdio.h>
-
-void print_head(void)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_thread\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_THREAD_H\n");
-  printf("#define __UM_THREAD_H\n");
-  printf("\n");
-}
-
-void print_constant_ptr(char *name, int value)
-{
-  printf("#define %s(task) ((unsigned long *) "
-         "&(((char *) (task))[%d]))\n", name, value);
-}
-
-void print_constant(char *name, char *type, int value)
-{
-  printf("#define %s(task) *((%s *) &(((char *) (task))[%d]))\n", name, type, 
-         value);
-}
-
-void print_tail(void)
-{
-  printf("\n");
-  printf("#endif\n");
-}
diff --git a/arch/um/sys-ppc/ptrace.c b/arch/um/sys-ppc/ptrace.c
index a971366d3277..8e71b47f2b8e 100644
--- a/arch/um/sys-ppc/ptrace.c
+++ b/arch/um/sys-ppc/ptrace.c
@@ -8,6 +8,25 @@ int putreg(struct task_struct *child, unsigned long regno,
         return 0;
 }
 
+int poke_user(struct task_struct *child, long addr, long data)
+{
+        if ((addr & 3) || addr < 0)
+                return -EIO;
+
+        if (addr < MAX_REG_OFFSET)
+                return putreg(child, addr, data);
+
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                  addr -= offsetof(struct user, u_debugreg[0]);
+                  addr = addr >> 2;
+                  if((addr == 4) || (addr == 5)) return -EIO;
+                  child->thread.arch.debugregs[addr] = data;
+                  return 0;
+        }
+        return -EIO;
+}
+
 unsigned long getreg(struct task_struct *child, unsigned long regno)
 {
         unsigned long retval = ~0UL;
@@ -16,6 +35,27 @@ unsigned long getreg(struct task_struct *child, unsigned long regno)
         return retval;
 }
 
+int peek_user(struct task_struct *child, long addr, long data)
+{
+        /* read the word at location addr in the USER area. */
+        unsigned long tmp;
+
+        if ((addr & 3) || addr < 0)
+                return -EIO;
+
+        tmp = 0;  /* Default return condition */
+        if(addr < MAX_REG_OFFSET){
+                tmp = getreg(child, addr);
+        }
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                addr -= offsetof(struct user, u_debugreg[0]);
+                addr = addr >> 2;
+                tmp = child->thread.arch.debugregs[addr];
+        }
+        return put_user(tmp, (unsigned long *) data);
+}
+
 /*
  * Overrides for Emacs so that we follow Linus's tabbing style.
  * Emacs will notice this stuff at the end of the file and automatically
diff --git a/arch/um/sys-x86_64/Makefile b/arch/um/sys-x86_64/Makefile
index d7ed2f7908df..608466ad6b22 100644
--- a/arch/um/sys-x86_64/Makefile
+++ b/arch/um/sys-x86_64/Makefile
@@ -4,24 +4,20 @@
 # Licensed under the GPL
 #
 
+#XXX: why into lib-y?
 lib-y = bitops.o bugs.o csum-partial.o delay.o fault.o mem.o memcpy.o \
         ptrace.o ptrace_user.o semaphore.o sigcontext.o signal.o \
         syscalls.o sysrq.o thunk.o syscall_table.o
 
-USER_OBJS := ptrace_user.o sigcontext.o
+obj-y := ksyms.o
+obj-$(CONFIG_MODULES) += module.o um_module.o
 
-include arch/um/scripts/Makefile.rules
+USER_OBJS := ptrace_user.o sigcontext.o
 
 SYMLINKS = bitops.c csum-copy.S csum-partial.c csum-wrappers.c memcpy.S \
-        semaphore.c thunk.S
-
-# this needs to be before the foreach, because clean-files does not accept
-# complete paths like $(src)/$f.
-clean-files := $(SYMLINKS)
+        semaphore.c thunk.S module.c
 
-targets += $(SYMLINKS)
-
-SYMLINKS := $(foreach f,$(SYMLINKS),$(obj)/$f)
+include arch/um/scripts/Makefile.rules
 
 bitops.c-dir = lib
 csum-copy.S-dir = lib
@@ -30,8 +26,6 @@ csum-wrappers.c-dir = lib
 memcpy.S-dir = lib
 semaphore.c-dir = kernel
 thunk.S-dir = lib
+module.c-dir = kernel
 
-$(SYMLINKS): FORCE
-        $(call if_changed,make_link)
-
-CFLAGS_csum-partial.o := -Dcsum_partial=arch_csum_partial
+subdir- := util
diff --git a/arch/um/sys-x86_64/delay.c b/arch/um/sys-x86_64/delay.c
index f3b5187942b4..137f4446b439 100644
--- a/arch/um/sys-x86_64/delay.c
+++ b/arch/um/sys-x86_64/delay.c
@@ -5,22 +5,37 @@
  * Licensed under the GPL
  */
 
-#include "asm/processor.h"
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <asm/processor.h>
+#include <asm/param.h>
 
 void __delay(unsigned long loops)
 {
         unsigned long i;
 
-        for(i = 0; i < loops; i++) ;
+        for(i = 0; i < loops; i++)
+                cpu_relax();
 }
 
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
+void __udelay(unsigned long usecs)
+{
+        unsigned long i, n;
+
+        n = (loops_per_jiffy * HZ * usecs) / MILLION;
+        for(i=0;i<n;i++)
+                cpu_relax();
+}
+
+EXPORT_SYMBOL(__udelay);
+
+void __const_udelay(unsigned long usecs)
+{
+        unsigned long i, n;
+
+        n = (loops_per_jiffy * HZ * usecs) / MILLION;
+        for(i=0;i<n;i++)
+                cpu_relax();
+}
+
+EXPORT_SYMBOL(__const_udelay);
diff --git a/arch/um/sys-x86_64/kernel-offsets.c b/arch/um/sys-x86_64/kernel-offsets.c
new file mode 100644
index 000000000000..220e875cbe29
--- /dev/null
+++ b/arch/um/sys-x86_64/kernel-offsets.c
@@ -0,0 +1,24 @@
+#include <linux/config.h>
+#include <linux/stddef.h>
+#include <linux/sched.h>
+#include <linux/time.h>
+#include <asm/page.h>
+
+#define DEFINE(sym, val) \
+        asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+
+#define DEFINE_STR1(x) #x
+#define DEFINE_STR(sym, val) asm volatile("\n->" #sym " " DEFINE_STR1(val) " " #val: : )
+
+#define BLANK() asm volatile("\n->" : : )
+
+#define OFFSET(sym, str, mem) \
+        DEFINE(sym, offsetof(struct str, mem));
+
+void foo(void)
+{
+#ifdef CONFIG_MODE_TT
+        OFFSET(TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
+#endif
+#include <common-offsets.h>
+}
diff --git a/arch/um/sys-x86_64/ksyms.c b/arch/um/sys-x86_64/ksyms.c
new file mode 100644
index 000000000000..859273808203
--- /dev/null
+++ b/arch/um/sys-x86_64/ksyms.c
@@ -0,0 +1,19 @@
+#include "linux/module.h"
+#include "linux/in6.h"
+#include "linux/rwsem.h"
+#include "asm/byteorder.h"
+#include "asm/semaphore.h"
+#include "asm/uaccess.h"
+#include "asm/checksum.h"
+#include "asm/errno.h"
+
+EXPORT_SYMBOL(__down_failed);
+EXPORT_SYMBOL(__down_failed_interruptible);
+EXPORT_SYMBOL(__down_failed_trylock);
+EXPORT_SYMBOL(__up_wakeup);
+
+/*XXX: we need them because they would be exported by x86_64 */
+EXPORT_SYMBOL(__memcpy);
+
+/* Networking helper routines. */
+EXPORT_SYMBOL(ip_compute_csum);
diff --git a/arch/um/sys-x86_64/ptrace.c b/arch/um/sys-x86_64/ptrace.c
index 8c146b2a1e00..74eee5c7c6dd 100644
--- a/arch/um/sys-x86_64/ptrace.c
+++ b/arch/um/sys-x86_64/ptrace.c
@@ -5,10 +5,11 @@
  */
 
 #define __FRAME_OFFSETS
-#include "asm/ptrace.h"
-#include "linux/sched.h"
-#include "linux/errno.h"
-#include "asm/elf.h"
+#include <asm/ptrace.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <asm/uaccess.h>
+#include <asm/elf.h>
 
 /* XXX x86_64 */
 unsigned long not_ss;
@@ -62,6 +63,27 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         return 0;
 }
 
+int poke_user(struct task_struct *child, long addr, long data)
+{
+        if ((addr & 3) || addr < 0)
+                return -EIO;
+
+        if (addr < MAX_REG_OFFSET)
+                return putreg(child, addr, data);
+
+#if 0 /* Need x86_64 debugregs handling */
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                addr -= offsetof(struct user, u_debugreg[0]);
+                addr = addr >> 2;
+                if((addr == 4) || (addr == 5)) return -EIO;
+                child->thread.arch.debugregs[addr] = data;
+                return 0;
+        }
+#endif
+        return -EIO;
+}
+
 unsigned long getreg(struct task_struct *child, int regno)
 {
         unsigned long retval = ~0UL;
@@ -84,6 +106,29 @@ unsigned long getreg(struct task_struct *child, int regno)
         return retval;
 }
 
+int peek_user(struct task_struct *child, long addr, long data)
+{
+        /* read the word at location addr in the USER area. */
+        unsigned long tmp;
+
+        if ((addr & 3) || addr < 0)
+                return -EIO;
+
+        tmp = 0;  /* Default return condition */
+        if(addr < MAX_REG_OFFSET){
+                tmp = getreg(child, addr);
+        }
+#if 0 /* Need x86_64 debugregs handling */
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                addr -= offsetof(struct user, u_debugreg[0]);
+                addr = addr >> 2;
+                tmp = child->thread.arch.debugregs[addr];
+        }
+#endif
+        return put_user(tmp, (unsigned long *) data);
+}
+
 void arch_switch(void)
 {
 /* XXX
diff --git a/arch/um/sys-x86_64/signal.c b/arch/um/sys-x86_64/signal.c
index 5bc5a0d796e5..73a7926f7370 100644
--- a/arch/um/sys-x86_64/signal.c
+++ b/arch/um/sys-x86_64/signal.c
@@ -57,7 +57,7 @@ static int copy_sc_from_user_skas(struct pt_regs *regs,
 int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
                         struct pt_regs *regs, unsigned long mask)
 {
-        unsigned long eflags;
+        struct faultinfo * fi = &current->thread.arch.faultinfo;
         int err = 0;
 
         err |= __put_user(0, &to->gs);
@@ -84,14 +84,16 @@ int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
         err |= PUTREG(regs, R14, to, r14);
         err |= PUTREG(regs, R15, to, r15);
         err |= PUTREG(regs, CS, to, cs); /* XXX x86_64 doesn't do this */
-        err |= __put_user(current->thread.err, &to->err);
-        err |= __put_user(current->thread.trap_no, &to->trapno);
+
+        err |= __put_user(fi->cr2, &to->cr2);
+        err |= __put_user(fi->error_code, &to->err);
+        err |= __put_user(fi->trap_no, &to->trapno);
+
         err |= PUTREG(regs, RIP, to, rip);
         err |= PUTREG(regs, EFLAGS, to, eflags);
 #undef PUTREG
 
         err |= __put_user(mask, &to->oldmask);
-        err |= __put_user(current->thread.cr2, &to->cr2);
 
         return(err);
 }
@@ -166,7 +168,7 @@ int setup_signal_stack_si(unsigned long stack_top, int sig,
 
         frame = (struct rt_sigframe __user *)
                 round_down(stack_top - sizeof(struct rt_sigframe), 16) - 8;
-        frame -= 128;
+        ((unsigned char *) frame) -= 128;
 
         if (!access_ok(VERIFY_WRITE, fp, sizeof(struct _fpstate)))
                 goto out;
diff --git a/arch/um/sys-x86_64/syscalls.c b/arch/um/sys-x86_64/syscalls.c
index ab4b0abf8af3..d4a59657fb99 100644
--- a/arch/um/sys-x86_64/syscalls.c
+++ b/arch/um/sys-x86_64/syscalls.c
@@ -7,12 +7,15 @@
 #include "linux/linkage.h"
 #include "linux/slab.h"
 #include "linux/shm.h"
+#include "linux/utsname.h"
+#include "linux/personality.h"
 #include "asm/uaccess.h"
 #define __FRAME_OFFSETS
 #include "asm/ptrace.h"
 #include "asm/unistd.h"
 #include "asm/prctl.h" /* XXX This should get the constants from libc */
 #include "choose-mode.h"
+#include "kern.h"
 
 asmlinkage long sys_uname64(struct new_utsname __user * name)
 {
@@ -42,6 +45,8 @@ long sys_modify_ldt_tt(int func, void *ptr, unsigned long bytecount)
 #ifdef CONFIG_MODE_SKAS
 extern int userspace_pid[];
 
+#include "skas_ptrace.h"
+
 long sys_modify_ldt_skas(int func, void *ptr, unsigned long bytecount)
 {
         struct ptrace_ldt ldt;
diff --git a/arch/um/sys-x86_64/um_module.c b/arch/um/sys-x86_64/um_module.c
new file mode 100644
index 000000000000..8b8eff1bd977
--- /dev/null
+++ b/arch/um/sys-x86_64/um_module.c
@@ -0,0 +1,19 @@
+#include <linux/vmalloc.h>
+#include <linux/moduleloader.h>
+
+/*Copied from i386 arch/i386/kernel/module.c */
+void *module_alloc(unsigned long size)
+{
+        if (size == 0)
+                return NULL;
+        return vmalloc_exec(size);
+}
+
+/* Free memory returned from module_alloc */
+void module_free(struct module *mod, void *module_region)
+{
+        vfree(module_region);
+        /* FIXME: If module_region == mod->init_region, trim exception
+           table entries. */
+}
+
diff --git a/arch/um/sys-x86_64/user-offsets.c b/arch/um/sys-x86_64/user-offsets.c
new file mode 100644
index 000000000000..513d17ceafd4
--- /dev/null
+++ b/arch/um/sys-x86_64/user-offsets.c
@@ -0,0 +1,86 @@
+#include <stdio.h>
+#include <stddef.h>
+#include <signal.h>
+#define __FRAME_OFFSETS
+#include <asm/ptrace.h>
+#include <asm/types.h>
+/* For some reason, x86_64 defines u64 and u32 only in <pci/types.h>, which I
+ * refuse to include here, even though they're used throughout the headers.
+ * These are used in asm/user.h, and that include can't be avoided because of
+ * the sizeof(struct user_regs_struct) below.
+ */
+typedef __u64 u64;
+typedef __u32 u32;
+#include <asm/user.h>
+
+#define DEFINE(sym, val) \
+        asm volatile("\n->" #sym " %0 " #val : : "i" (val))
+
+#define OFFSET(sym, str, mem) \
+        DEFINE(sym, offsetof(struct str, mem));
+
+void foo(void)
+{
+        OFFSET(SC_RBX, sigcontext, rbx);
+        OFFSET(SC_RCX, sigcontext, rcx);
+        OFFSET(SC_RDX, sigcontext, rdx);
+        OFFSET(SC_RSI, sigcontext, rsi);
+        OFFSET(SC_RDI, sigcontext, rdi);
+        OFFSET(SC_RBP, sigcontext, rbp);
+        OFFSET(SC_RAX, sigcontext, rax);
+        OFFSET(SC_R8, sigcontext, r8);
+        OFFSET(SC_R9, sigcontext, r9);
+        OFFSET(SC_R10, sigcontext, r10);
+        OFFSET(SC_R11, sigcontext, r11);
+        OFFSET(SC_R12, sigcontext, r12);
+        OFFSET(SC_R13, sigcontext, r13);
+        OFFSET(SC_R14, sigcontext, r14);
+        OFFSET(SC_R15, sigcontext, r15);
+        OFFSET(SC_IP, sigcontext, rip);
+        OFFSET(SC_SP, sigcontext, rsp);
+        OFFSET(SC_CR2, sigcontext, cr2);
+        OFFSET(SC_ERR, sigcontext, err);
+        OFFSET(SC_TRAPNO, sigcontext, trapno);
+        OFFSET(SC_CS, sigcontext, cs);
+        OFFSET(SC_FS, sigcontext, fs);
+        OFFSET(SC_GS, sigcontext, gs);
+        OFFSET(SC_EFLAGS, sigcontext, eflags);
+        OFFSET(SC_SIGMASK, sigcontext, oldmask);
+#if 0
+        OFFSET(SC_ORIG_RAX, sigcontext, orig_rax);
+        OFFSET(SC_DS, sigcontext, ds);
+        OFFSET(SC_ES, sigcontext, es);
+        OFFSET(SC_SS, sigcontext, ss);
+#endif
+
+        DEFINE(HOST_FRAME_SIZE, FRAME_SIZE);
+        DEFINE(HOST_RBX, RBX);
+        DEFINE(HOST_RCX, RCX);
+        DEFINE(HOST_RDI, RDI);
+        DEFINE(HOST_RSI, RSI);
+        DEFINE(HOST_RDX, RDX);
+        DEFINE(HOST_RBP, RBP);
+        DEFINE(HOST_RAX, RAX);
+        DEFINE(HOST_R8, R8);
+        DEFINE(HOST_R9, R9);
+        DEFINE(HOST_R10, R10);
+        DEFINE(HOST_R11, R11);
+        DEFINE(HOST_R12, R12);
+        DEFINE(HOST_R13, R13);
+        DEFINE(HOST_R14, R14);
+        DEFINE(HOST_R15, R15);
+        DEFINE(HOST_ORIG_RAX, ORIG_RAX);
+        DEFINE(HOST_CS, CS);
+        DEFINE(HOST_SS, SS);
+        DEFINE(HOST_EFLAGS, EFLAGS);
+#if 0
+        DEFINE(HOST_FS, FS);
+        DEFINE(HOST_GS, GS);
+        DEFINE(HOST_DS, DS);
+        DEFINE(HOST_ES, ES);
+#endif
+
+        DEFINE(HOST_IP, RIP);
+        DEFINE(HOST_SP, RSP);
+        DEFINE(__UM_FRAME_SIZE, sizeof(struct user_regs_struct));
+}
diff --git a/arch/um/sys-x86_64/util/Makefile b/arch/um/sys-x86_64/util/Makefile
index 002607980864..75b052cfc206 100644
--- a/arch/um/sys-x86_64/util/Makefile
+++ b/arch/um/sys-x86_64/util/Makefile
@@ -4,7 +4,5 @@
 hostprogs-y     := mk_sc mk_thread
 always          := $(hostprogs-y)
 
-mk_thread-objs  := mk_thread_kern.o mk_thread_user.o
-
-HOSTCFLAGS_mk_thread_kern.o     := $(CFLAGS) $(CPPFLAGS)
-HOSTCFLAGS_mk_thread_user.o     := $(USER_CFLAGS)
+HOSTCFLAGS_mk_sc.o := -I$(objtree)/arch/um
+HOSTCFLAGS_mk_thread.o := -I$(objtree)/arch/um
diff --git a/arch/um/sys-x86_64/util/mk_sc.c b/arch/um/sys-x86_64/util/mk_sc.c
index c236e213918d..7619bc377c1f 100644
--- a/arch/um/sys-x86_64/util/mk_sc.c
+++ b/arch/um/sys-x86_64/util/mk_sc.c
@@ -3,56 +3,45 @@
  */
 
 #include <stdio.h>
-#include <signal.h>
-#include <linux/stddef.h>
+#include <user-offsets.h>
 
-#define SC_OFFSET(name, field) \
-  printf("#define " name \
-         "(sc) *((unsigned long *) &(((char *) (sc))[%ld]))\n",\
-         offsetof(struct sigcontext, field))
-
-#define SC_FP_OFFSET(name, field) \
-  printf("#define " name \
-         "(sc) *((unsigned long *) &(((char *) (SC_FPSTATE(sc)))[%ld]))\n",\
-         offsetof(struct _fpstate, field))
-
-#define SC_FP_OFFSET_PTR(name, field, type) \
-  printf("#define " name \
-         "(sc) ((" type " *) &(((char *) (SC_FPSTATE(sc)))[%d]))\n",\
-         offsetof(struct _fpstate, field))
+#define SC_OFFSET(name) \
+  printf("#define " #name \
+         "(sc) *((unsigned long *) &(((char *) (sc))[%d]))\n",\
+         name)
 
 int main(int argc, char **argv)
 {
-  SC_OFFSET("SC_RBX", rbx);
-  SC_OFFSET("SC_RCX", rcx);
-  SC_OFFSET("SC_RDX", rdx);
-  SC_OFFSET("SC_RSI", rsi);
-  SC_OFFSET("SC_RDI", rdi);
-  SC_OFFSET("SC_RBP", rbp);
-  SC_OFFSET("SC_RAX", rax);
-  SC_OFFSET("SC_R8", r8);
-  SC_OFFSET("SC_R9", r9);
-  SC_OFFSET("SC_R10", r10);
-  SC_OFFSET("SC_R11", r11);
-  SC_OFFSET("SC_R12", r12);
-  SC_OFFSET("SC_R13", r13);
-  SC_OFFSET("SC_R14", r14);
-  SC_OFFSET("SC_R15", r15);
-  SC_OFFSET("SC_IP", rip);
-  SC_OFFSET("SC_SP", rsp);
-  SC_OFFSET("SC_CR2", cr2);
-  SC_OFFSET("SC_ERR", err);
-  SC_OFFSET("SC_TRAPNO", trapno);
-  SC_OFFSET("SC_CS", cs);
-  SC_OFFSET("SC_FS", fs);
-  SC_OFFSET("SC_GS", gs);
-  SC_OFFSET("SC_EFLAGS", eflags);
-  SC_OFFSET("SC_SIGMASK", oldmask);
+  SC_OFFSET(SC_RBX);
+  SC_OFFSET(SC_RCX);
+  SC_OFFSET(SC_RDX);
+  SC_OFFSET(SC_RSI);
+  SC_OFFSET(SC_RDI);
+  SC_OFFSET(SC_RBP);
+  SC_OFFSET(SC_RAX);
+  SC_OFFSET(SC_R8);
+  SC_OFFSET(SC_R9);
+  SC_OFFSET(SC_R10);
+  SC_OFFSET(SC_R11);
+  SC_OFFSET(SC_R12);
+  SC_OFFSET(SC_R13);
+  SC_OFFSET(SC_R14);
+  SC_OFFSET(SC_R15);
+  SC_OFFSET(SC_IP);
+  SC_OFFSET(SC_SP);
+  SC_OFFSET(SC_CR2);
+  SC_OFFSET(SC_ERR);
+  SC_OFFSET(SC_TRAPNO);
+  SC_OFFSET(SC_CS);
+  SC_OFFSET(SC_FS);
+  SC_OFFSET(SC_GS);
+  SC_OFFSET(SC_EFLAGS);
+  SC_OFFSET(SC_SIGMASK);
 #if 0
-  SC_OFFSET("SC_ORIG_RAX", orig_rax);
-  SC_OFFSET("SC_DS", ds);
-  SC_OFFSET("SC_ES", es);
-  SC_OFFSET("SC_SS", ss);
+  SC_OFFSET(SC_ORIG_RAX);
+  SC_OFFSET(SC_DS);
+  SC_OFFSET(SC_ES);
+  SC_OFFSET(SC_SS);
 #endif
   return(0);
 }
diff --git a/arch/um/sys-x86_64/util/mk_thread.c b/arch/um/sys-x86_64/util/mk_thread.c
new file mode 100644
index 000000000000..15517396e9cf
--- /dev/null
+++ b/arch/um/sys-x86_64/util/mk_thread.c
@@ -0,0 +1,20 @@
+#include <stdio.h>
+#include <kernel-offsets.h>
+
+int main(int argc, char **argv)
+{
+  printf("/*\n");
+  printf(" * Generated by mk_thread\n");
+  printf(" */\n");
+  printf("\n");
+  printf("#ifndef __UM_THREAD_H\n");
+  printf("#define __UM_THREAD_H\n");
+  printf("\n");
+#ifdef TASK_EXTERN_PID
+  printf("#define TASK_EXTERN_PID(task) *((int *) &(((char *) (task))[%d]))\n",
+         TASK_EXTERN_PID);
+#endif
+  printf("\n");
+  printf("#endif\n");
+  return(0);
+}
diff --git a/arch/um/sys-x86_64/util/mk_thread_kern.c b/arch/um/sys-x86_64/util/mk_thread_kern.c
deleted file mode 100644
index a281673f02b2..000000000000
--- a/arch/um/sys-x86_64/util/mk_thread_kern.c
+++ /dev/null
@@ -1,21 +0,0 @@
-#include "linux/config.h"
-#include "linux/stddef.h"
-#include "linux/sched.h"
-
-extern void print_head(void);
-extern void print_constant_ptr(char *name, int value);
-extern void print_constant(char *name, char *type, int value);
-extern void print_tail(void);
-
-#define THREAD_OFFSET(field) offsetof(struct task_struct, thread.field)
-
-int main(int argc, char **argv)
-{
-  print_head();
-#ifdef CONFIG_MODE_TT
-  print_constant("TASK_EXTERN_PID", "int", THREAD_OFFSET(mode.tt.extern_pid));
-#endif
-  print_tail();
-  return(0);
-}
-
diff --git a/arch/um/sys-x86_64/util/mk_thread_user.c b/arch/um/sys-x86_64/util/mk_thread_user.c
deleted file mode 100644
index 7989725568b8..000000000000
--- a/arch/um/sys-x86_64/util/mk_thread_user.c
+++ /dev/null
@@ -1,30 +0,0 @@
-#include <stdio.h>
-
-void print_head(void)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_thread\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_THREAD_H\n");
-  printf("#define __UM_THREAD_H\n");
-  printf("\n");
-}
-
-void print_constant_ptr(char *name, int value)
-{
-  printf("#define %s(task) ((unsigned long *) "
-         "&(((char *) (task))[%d]))\n", name, value);
-}
-
-void print_constant(char *name, char *type, int value)
-{
-  printf("#define %s(task) *((%s *) &(((char *) (task))[%d]))\n", name, type,
-         value);
-}
-
-void print_tail(void)
-{
-  printf("\n");
-  printf("#endif\n");
-}
diff --git a/arch/um/util/Makefile b/arch/um/util/Makefile
index e2ab71209f3f..4c7551c28033 100644
--- a/arch/um/util/Makefile
+++ b/arch/um/util/Makefile
@@ -1,8 +1,5 @@
 hostprogs-y             := mk_task mk_constants
 always                  := $(hostprogs-y)
 
-mk_task-objs            := mk_task_user.o mk_task_kern.o
-mk_constants-objs       := mk_constants_user.o mk_constants_kern.o
-
-HOSTCFLAGS_mk_task_kern.o       := $(CFLAGS) $(CPPFLAGS)
-HOSTCFLAGS_mk_constants_kern.o  := $(CFLAGS) $(CPPFLAGS)
+HOSTCFLAGS_mk_task.o := -I$(objtree)/arch/um
+HOSTCFLAGS_mk_constants.o := -I$(objtree)/arch/um
diff --git a/arch/um/util/mk_constants.c b/arch/um/util/mk_constants.c
new file mode 100644
index 000000000000..ab217becc36a
--- /dev/null
+++ b/arch/um/util/mk_constants.c
@@ -0,0 +1,32 @@
+#include <stdio.h>
+#include <kernel-offsets.h>
+
+#define SHOW_INT(sym) printf("#define %s %d\n", #sym, sym)
+#define SHOW_STR(sym) printf("#define %s %s\n", #sym, sym)
+
+int main(int argc, char **argv)
+{
+  printf("/*\n");
+  printf(" * Generated by mk_constants\n");
+  printf(" */\n");
+  printf("\n");
+  printf("#ifndef __UM_CONSTANTS_H\n");
+  printf("#define __UM_CONSTANTS_H\n");
+  printf("\n");
+
+  SHOW_INT(UM_KERN_PAGE_SIZE);
+
+  SHOW_STR(UM_KERN_EMERG);
+  SHOW_STR(UM_KERN_ALERT);
+  SHOW_STR(UM_KERN_CRIT);
+  SHOW_STR(UM_KERN_ERR);
+  SHOW_STR(UM_KERN_WARNING);
+  SHOW_STR(UM_KERN_NOTICE);
+  SHOW_STR(UM_KERN_INFO);
+  SHOW_STR(UM_KERN_DEBUG);
+
+  SHOW_INT(UM_NSEC_PER_SEC);
+  printf("\n");
+  printf("#endif\n");
+  return(0);
+}
diff --git a/arch/um/util/mk_constants_kern.c b/arch/um/util/mk_constants_kern.c
deleted file mode 100644
index cdcb1232a1ea..000000000000
--- a/arch/um/util/mk_constants_kern.c
+++ /dev/null
@@ -1,28 +0,0 @@
-#include "linux/kernel.h"
-#include "linux/stringify.h"
-#include "linux/time.h"
-#include "asm/page.h"
-
-extern void print_head(void);
-extern void print_constant_str(char *name, char *value);
-extern void print_constant_int(char *name, int value);
-extern void print_tail(void);
-
-int main(int argc, char **argv)
-{
-  print_head();
-  print_constant_int("UM_KERN_PAGE_SIZE", PAGE_SIZE);
-
-  print_constant_str("UM_KERN_EMERG", KERN_EMERG);
-  print_constant_str("UM_KERN_ALERT", KERN_ALERT);
-  print_constant_str("UM_KERN_CRIT", KERN_CRIT);
-  print_constant_str("UM_KERN_ERR", KERN_ERR);
-  print_constant_str("UM_KERN_WARNING", KERN_WARNING);
-  print_constant_str("UM_KERN_NOTICE", KERN_NOTICE);
-  print_constant_str("UM_KERN_INFO", KERN_INFO);
-  print_constant_str("UM_KERN_DEBUG", KERN_DEBUG);
-
-  print_constant_int("UM_NSEC_PER_SEC", NSEC_PER_SEC);
-  print_tail();
-  return(0);
-}
diff --git a/arch/um/util/mk_constants_user.c b/arch/um/util/mk_constants_user.c
deleted file mode 100644
index 8f4d7e50be7c..000000000000
--- a/arch/um/util/mk_constants_user.c
+++ /dev/null
@@ -1,28 +0,0 @@
-#include <stdio.h>
-
-void print_head(void)
-{
-  printf("/*\n");
-  printf(" * Generated by mk_constants\n");
-  printf(" */\n");
-  printf("\n");
-  printf("#ifndef __UM_CONSTANTS_H\n");
-  printf("#define __UM_CONSTANTS_H\n");
-  printf("\n");
-}
-
-void print_constant_str(char *name, char *value)
-{
-  printf("#define %s \"%s\"\n", name, value);
-}
-
-void print_constant_int(char *name, int value)
-{
-  printf("#define %s %d\n", name, value);
-}
-
-void print_tail(void)
-{
-  printf("\n");
-  printf("#endif\n");
-}
diff --git a/arch/um/util/mk_task_user.c b/arch/um/util/mk_task.c
index 9db849f3f3ac..36c9606505e2 100644
--- a/arch/um/util/mk_task_user.c
+++ b/arch/um/util/mk_task.c
@@ -1,18 +1,19 @@
 #include <stdio.h>
+#include <kernel-offsets.h>
 
-void print(char *name, char *type, int offset)
+void print_ptr(char *name, char *type, int offset)
 {
-  printf("#define %s(task) *((%s *) &(((char *) (task))[%d]))\n", name, type,
+  printf("#define %s(task) ((%s *) &(((char *) (task))[%d]))\n", name, type,
          offset);
 }
 
-void print_ptr(char *name, char *type, int offset)
+void print(char *name, char *type, int offset)
 {
-  printf("#define %s(task) ((%s *) &(((char *) (task))[%d]))\n", name, type,
+  printf("#define %s(task) *((%s *) &(((char *) (task))[%d]))\n", name, type,
          offset);
 }
 
-void print_head(void)
+int main(int argc, char **argv)
 {
   printf("/*\n");
   printf(" * Generated by mk_task\n");
@@ -21,10 +22,9 @@ void print_head(void)
   printf("#ifndef __TASK_H\n");
   printf("#define __TASK_H\n");
   printf("\n");
-}
-
-void print_tail(void)
-{
+  print_ptr("TASK_REGS", "union uml_pt_regs", TASK_REGS);
+  print("TASK_PID", "int", TASK_PID);
   printf("\n");
   printf("#endif\n");
+  return(0);
 }
diff --git a/arch/um/util/mk_task_kern.c b/arch/um/util/mk_task_kern.c
deleted file mode 100644
index c218103315ed..000000000000
--- a/arch/um/util/mk_task_kern.c
+++ /dev/null
@@ -1,17 +0,0 @@
-#include "linux/sched.h"
-#include "linux/stddef.h"
-
-extern void print(char *name, char *type, int offset);
-extern void print_ptr(char *name, char *type, int offset);
-extern void print_head(void);
-extern void print_tail(void);
-
-int main(int argc, char **argv)
-{
-  print_head();
-  print_ptr("TASK_REGS", "union uml_pt_regs", 
-            offsetof(struct task_struct, thread.regs));
-  print("TASK_PID", "int", offsetof(struct task_struct, pid));
-  print_tail();
-  return(0);
-}
diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig
index 44ee7f6acf7b..82cb2a3f127a 100644
--- a/arch/x86_64/Kconfig
+++ b/arch/x86_64/Kconfig
@@ -303,6 +303,20 @@ config HPET_TIMER
           as it is off-chip.  You can find the HPET spec at
           <http://www.intel.com/labs/platcomp/hpet/hpetspec.htm>.
 
+config X86_PM_TIMER
+        bool "PM timer"
+        default y
+        help
+          Support the ACPI PM timer for time keeping. This is slow,
+          but is useful on some chipsets without HPET on systems with more
+          than one CPU. On a single processor or single socket multi core
+          system it is normally not required.
+          When the PM timer is active 64bit vsyscalls are disabled
+          and should not be enabled (/proc/sys/kernel/vsyscall64 should
+          not be changed).
+          The kernel selects the PM timer only as a last resort, so it is
+          useful to enable just in case.
+
 config HPET_EMULATE_RTC
         bool "Provide RTC interrupt"
         depends on HPET_TIMER && RTC=y
diff --git a/arch/x86_64/boot/bootsect.S b/arch/x86_64/boot/bootsect.S
index bb15d406ee95..011b7a4993d4 100644
--- a/arch/x86_64/boot/bootsect.S
+++ b/arch/x86_64/boot/bootsect.S
@@ -63,7 +63,7 @@ msg_loop:
         jz      die
         movb    $0xe, %ah
         movw    $7, %bx
-        int     $0x10
+        int     $0x10
         jmp     msg_loop
 
 die:
@@ -71,7 +71,7 @@ die:
         xorw    %ax, %ax
         int     $0x16
         int     $0x19
-        
+
         # int 0x19 should never return.  In case it does anyway,
         # invoke the BIOS reset code...
         ljmp    $0xf000,$0xfff0
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 9ce51dee30b3..569595b74c7c 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.11-bk7
-# Sat Mar 12 23:43:44 2005
+# Linux kernel version: 2.6.12-rc4
+# Fri May 13 06:39:11 2005
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -11,8 +11,6 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_X86_CMPXCHG=y
 CONFIG_EARLY_PRINTK=y
-CONFIG_HPET_TIMER=y
-CONFIG_HPET_EMULATE_RTC=y
 CONFIG_GENERIC_ISA_DMA=y
 CONFIG_GENERIC_IOMAP=y
 
@@ -22,6 +20,7 @@ CONFIG_GENERIC_IOMAP=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
@@ -33,7 +32,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_LOG_BUF_SHIFT=18
 # CONFIG_HOTPLUG is not set
 CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
@@ -43,10 +41,11 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_PRINTK=y
+CONFIG_BUG=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SHMEM=y
 CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
@@ -93,6 +92,9 @@ CONFIG_DISCONTIGMEM=y
 CONFIG_NUMA=y
 CONFIG_HAVE_DEC_LOCK=y
 CONFIG_NR_CPUS=8
+CONFIG_HPET_TIMER=y
+CONFIG_X86_PM_TIMER=y
+CONFIG_HPET_EMULATE_RTC=y
 CONFIG_GART_IOMMU=y
 CONFIG_SWIOTLB=y
 CONFIG_X86_MCE=y
@@ -100,6 +102,7 @@ CONFIG_X86_MCE_INTEL=y
 CONFIG_SECCOMP=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_ISA_DMA_API=y
 
 #
 # Power management options
@@ -129,7 +132,7 @@ CONFIG_ACPI_NUMA=y
 # CONFIG_ACPI_IBM is not set
 CONFIG_ACPI_TOSHIBA=y
 CONFIG_ACPI_BLACKLIST_YEAR=2001
-CONFIG_ACPI_DEBUG=y
+# CONFIG_ACPI_DEBUG is not set
 CONFIG_ACPI_BUS=y
 CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
@@ -141,6 +144,7 @@ CONFIG_ACPI_SYSTEM=y
 # CPU Frequency scaling
 #
 CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
 CONFIG_CPU_FREQ_STAT=y
 # CONFIG_CPU_FREQ_STAT_DETAILS is not set
@@ -150,7 +154,6 @@ CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_POWERSAVE is not set
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
-CONFIG_CPU_FREQ_TABLE=y
 
 #
 # CPUFreq processor drivers
@@ -164,6 +167,7 @@ CONFIG_X86_ACPI_CPUFREQ=y
 # shared options
 #
 CONFIG_X86_ACPI_CPUFREQ_PROC_INTF=y
+# CONFIG_X86_SPEEDSTEP_LIB is not set
 
 #
 # Bus options (PCI etc.)
@@ -172,9 +176,11 @@ CONFIG_PCI=y
 CONFIG_PCI_DIRECT=y
 CONFIG_PCI_MMCONFIG=y
 CONFIG_UNORDERED_IO=y
+# CONFIG_PCIEPORTBUS is not set
 CONFIG_PCI_MSI=y
 # CONFIG_PCI_LEGACY_PROC is not set
 # CONFIG_PCI_NAMES is not set
+# CONFIG_PCI_DEBUG is not set
 
 #
 # PCCARD (PCMCIA/CardBus) support
@@ -182,10 +188,6 @@ CONFIG_PCI_MSI=y
 # CONFIG_PCCARD is not set
 
 #
-# PC-card bridges
-#
-
-#
 # PCI Hotplug Support
 #
 # CONFIG_HOTPLUG_PCI is not set
@@ -254,7 +256,7 @@ CONFIG_LBD=y
 # IO Schedulers
 #
 CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
+# CONFIG_IOSCHED_AS is not set
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
@@ -308,7 +310,8 @@ CONFIG_BLK_DEV_AMD74XX=y
 CONFIG_BLK_DEV_PIIX=y
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
-# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+CONFIG_BLK_DEV_PDC202XX_NEW=y
+# CONFIG_PDC202XX_FORCE is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
 # CONFIG_BLK_DEV_SIS5513 is not set
@@ -353,7 +356,7 @@ CONFIG_BLK_DEV_SD=y
 #
 # SCSI low-level drivers
 #
-CONFIG_BLK_DEV_3W_XXXX_RAID=y
+# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
 # CONFIG_SCSI_AACRAID is not set
@@ -384,7 +387,6 @@ CONFIG_SCSI_SATA_VIA=y
 # CONFIG_SCSI_BUSLOGIC is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_EATA is not set
-# CONFIG_SCSI_EATA_PIO is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_GDTH is not set
 # CONFIG_SCSI_IPS is not set
@@ -392,7 +394,6 @@ CONFIG_SCSI_SATA_VIA=y
 # CONFIG_SCSI_INIA100 is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
 # CONFIG_SCSI_IPR is not set
-# CONFIG_SCSI_QLOGIC_ISP is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 CONFIG_SCSI_QLA2XXX=y
@@ -401,6 +402,7 @@ CONFIG_SCSI_QLA2XXX=y
 # CONFIG_SCSI_QLA2300 is not set
 # CONFIG_SCSI_QLA2322 is not set
 # CONFIG_SCSI_QLA6312 is not set
+# CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
 # CONFIG_SCSI_DEBUG is not set
@@ -437,7 +439,6 @@ CONFIG_NET=y
 #
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
-# CONFIG_NETLINK_DEV is not set
 CONFIG_UNIX=y
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
@@ -502,7 +503,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
-# CONFIG_TUN is not set
+CONFIG_TUN=y
 
 #
 # ARCnet devices
@@ -525,8 +526,7 @@ CONFIG_MII=y
 # CONFIG_HP100 is not set
 CONFIG_NET_PCI=y
 # CONFIG_PCNET32 is not set
-CONFIG_AMD8111_ETH=y
-# CONFIG_AMD8111E_NAPI is not set
+# CONFIG_AMD8111_ETH is not set
 # CONFIG_ADAPTEC_STARFIRE is not set
 # CONFIG_B44 is not set
 CONFIG_FORCEDETH=y
@@ -536,7 +536,7 @@ CONFIG_FORCEDETH=y
 # CONFIG_FEALNX is not set
 # CONFIG_NATSEMI is not set
 # CONFIG_NE2K_PCI is not set
-CONFIG_8139CP=m
+CONFIG_8139CP=y
 CONFIG_8139TOO=y
 # CONFIG_8139TOO_PIO is not set
 # CONFIG_8139TOO_TUNE_TWISTER is not set
@@ -671,6 +671,7 @@ CONFIG_SERIAL_8250_NR_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -696,6 +697,7 @@ CONFIG_RTC=y
 #
 CONFIG_AGP=y
 CONFIG_AGP_AMD64=y
+CONFIG_AGP_INTEL=y
 # CONFIG_DRM is not set
 # CONFIG_MWAVE is not set
 CONFIG_RAW_DRIVER=y
@@ -703,7 +705,7 @@ CONFIG_HPET=y
 # CONFIG_HPET_RTC_IRQ is not set
 CONFIG_HPET_MMAP=y
 CONFIG_MAX_RAW_DEVS=256
-CONFIG_HANGCHECK_TIMER=y
+# CONFIG_HANGCHECK_TIMER is not set
 
 #
 # TPM devices
@@ -786,6 +788,8 @@ CONFIG_SOUND_ICH=y
 #
 # USB support
 #
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -797,8 +801,6 @@ CONFIG_USB_DEVICEFS=y
 # CONFIG_USB_DYNAMIC_MINORS is not set
 # CONFIG_USB_SUSPEND is not set
 # CONFIG_USB_OTG is not set
-CONFIG_USB_ARCH_HAS_HCD=y
-CONFIG_USB_ARCH_HAS_OHCI=y
 
 #
 # USB Host Controller Drivers
@@ -826,7 +828,6 @@ CONFIG_USB_PRINTER=y
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
-# CONFIG_USB_STORAGE_RW_DETECT is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
@@ -965,7 +966,7 @@ CONFIG_AUTOFS_FS=y
 # CD-ROM/DVD Filesystems
 #
 CONFIG_ISO9660_FS=y
-# CONFIG_JOLIET is not set
+CONFIG_JOLIET=y
 # CONFIG_ZISOFS is not set
 # CONFIG_UDF_FS is not set
 
@@ -1092,9 +1093,10 @@ CONFIG_OPROFILE=y
 #
 # Kernel hacking
 #
+# CONFIG_PRINTK_TIME is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
-# CONFIG_PRINTK_TIME is not set
+CONFIG_LOG_BUF_SHIFT=18
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_SPINLOCK is not set
diff --git a/arch/x86_64/kernel/Makefile b/arch/x86_64/kernel/Makefile
index 0a3318e08ab6..5ca4a4598fda 100644
--- a/arch/x86_64/kernel/Makefile
+++ b/arch/x86_64/kernel/Makefile
@@ -28,6 +28,7 @@ obj-$(CONFIG_GART_IOMMU)	+= pci-gart.o aperture.o
 obj-$(CONFIG_DUMMY_IOMMU)       += pci-nommu.o pci-dma.o
 obj-$(CONFIG_SWIOTLB)           += swiotlb.o
 obj-$(CONFIG_KPROBES)           += kprobes.o
+obj-$(CONFIG_X86_PM_TIMER)      += pmtimer.o
 
 obj-$(CONFIG_MODULES)           += module.o
 
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index 7e13545748e0..f8e6cc4fecd4 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -33,6 +33,7 @@
 #include <asm/mpspec.h>
 #include <asm/pgalloc.h>
 #include <asm/mach_apic.h>
+#include <asm/nmi.h>
 
 int apic_verbosity;
 
@@ -925,7 +926,7 @@ __init int oem_force_hpet_timer(void)
         unsigned id;
         DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
 
-        bitmap_empty(clustermap, NUM_APIC_CLUSTERS);
+        bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
 
         for (i = 0; i < NR_CPUS; i++) {
                 id = bios_cpu_apicid[i];
@@ -1056,7 +1057,7 @@ int __init APIC_init_uniprocessor (void)
                 nr_ioapics = 0;
 #endif
         setup_boot_APIC_clock();
-
+        check_nmi_watchdog();
         return 0;
 }
 
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index 1086b5fcac21..28817490fdc6 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -220,13 +220,18 @@ sysret_careful:
         jmp sysret_check
 
         /* Handle a signal */ 
-        /* edx: work flags (arg3) */
 sysret_signal:
         sti
+        testl $(_TIF_SIGPENDING|_TIF_NOTIFY_RESUME|_TIF_SINGLESTEP),%edx
+        jz    1f
+
+        /* Really a signal */
+        /* edx: work flags (arg3) */
         leaq do_notify_resume(%rip),%rax
         leaq -ARGOFFSET(%rsp),%rdi # &pt_regs -> arg1
         xorl %esi,%esi # oldset -> arg2
         call ptregscall_common
+1:      movl $_TIF_NEED_RESCHED,%edi
         jmp sysret_check
         
         /* Do syscall tracing */
@@ -484,6 +489,8 @@ retint_careful:
         jmp retint_check
         
 retint_signal:
+        testl $(_TIF_SIGPENDING|_TIF_NOTIFY_RESUME|_TIF_SINGLESTEP),%edx
+        jz    retint_swapgs
         sti
         SAVE_REST
         movq $-1,ORIG_RAX(%rsp)                         
@@ -492,8 +499,8 @@ retint_signal:
         call do_notify_resume
         RESTORE_REST
         cli
+        movl $_TIF_NEED_RESCHED,%edi
         GET_THREAD_INFO(%rcx)
-        movl $_TIF_WORK_MASK,%edi
         jmp retint_check
 
 #ifdef CONFIG_PREEMPT
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 60be58617eb9..80e9b498c443 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -42,6 +42,8 @@
 
 int sis_apic_bug; /* not actually supported, dummy for compile */
 
+static int no_timer_check;
+
 static DEFINE_SPINLOCK(ioapic_lock);
 
 /*
@@ -1601,7 +1603,7 @@ static inline void check_timer(void)
                  * Ok, does IRQ0 through the IOAPIC work?
                  */
                 unmask_IO_APIC_irq(0);
-                if (timer_irq_works()) {
+                if (!no_timer_check && timer_irq_works()) {
                         nmi_watchdog_default();
                         if (nmi_watchdog == NMI_IO_APIC) {
                                 disable_8259A_irq(0);
@@ -1671,6 +1673,13 @@ static inline void check_timer(void)
         panic("IO-APIC + timer doesn't work! Try using the 'noapic' kernel parameter\n");
 }
 
+static int __init notimercheck(char *s)
+{
+        no_timer_check = 1;
+        return 1;
+}
+__setup("no_timer_check", notimercheck);
+
 /*
  *
  * IRQ's that are handled by the PIC in the MPS IOAPIC case.
@@ -1804,76 +1813,6 @@ device_initcall(ioapic_init_sysfs);
 
 #define IO_APIC_MAX_ID          0xFE
 
-int __init io_apic_get_unique_id (int ioapic, int apic_id)
-{
-        union IO_APIC_reg_00 reg_00;
-        static physid_mask_t apic_id_map;
-        unsigned long flags;
-        int i = 0;
-
-        /*
-         * The P4 platform supports up to 256 APIC IDs on two separate APIC 
-         * buses (one for LAPICs, one for IOAPICs), where predecessors only 
-         * supports up to 16 on one shared APIC bus.
-         * 
-         * TBD: Expand LAPIC/IOAPIC support on P4-class systems to take full
-         *      advantage of new APIC bus architecture.
-         */
-
-        if (physids_empty(apic_id_map))
-                apic_id_map = phys_cpu_present_map;
-
-        spin_lock_irqsave(&ioapic_lock, flags);
-        reg_00.raw = io_apic_read(ioapic, 0);
-        spin_unlock_irqrestore(&ioapic_lock, flags);
-
-        if (apic_id >= IO_APIC_MAX_ID) {
-                apic_printk(APIC_QUIET, KERN_WARNING "IOAPIC[%d]: Invalid apic_id %d, trying "
-                        "%d\n", ioapic, apic_id, reg_00.bits.ID);
-                apic_id = reg_00.bits.ID;
-        }
-
-        /*
-         * Every APIC in a system must have a unique ID or we get lots of nice 
-         * 'stuck on smp_invalidate_needed IPI wait' messages.
-         */
-        if (physid_isset(apic_id, apic_id_map)) {
-
-                for (i = 0; i < IO_APIC_MAX_ID; i++) {
-                        if (!physid_isset(i, apic_id_map))
-                                break;
-                }
-
-                if (i == IO_APIC_MAX_ID)
-                        panic("Max apic_id exceeded!\n");
-
-                apic_printk(APIC_VERBOSE, KERN_WARNING "IOAPIC[%d]: apic_id %d already used, "
-                        "trying %d\n", ioapic, apic_id, i);
-
-                apic_id = i;
-        } 
-
-        physid_set(apic_id, apic_id_map);
-
-        if (reg_00.bits.ID != apic_id) {
-                reg_00.bits.ID = apic_id;
-
-                spin_lock_irqsave(&ioapic_lock, flags);
-                io_apic_write(ioapic, 0, reg_00.raw);
-                reg_00.raw = io_apic_read(ioapic, 0);
-                spin_unlock_irqrestore(&ioapic_lock, flags);
-
-                /* Sanity check */
-                if (reg_00.bits.ID != apic_id)
-                        panic("IOAPIC[%d]: Unable change apic_id!\n", ioapic);
-        }
-
-        apic_printk(APIC_VERBOSE,KERN_INFO "IOAPIC[%d]: Assigned apic_id %d\n", ioapic, apic_id);
-
-        return apic_id;
-}
-
-
 int __init io_apic_get_version (int ioapic)
 {
         union IO_APIC_reg_01    reg_01;
diff --git a/arch/x86_64/kernel/kprobes.c b/arch/x86_64/kernel/kprobes.c
index 4f2a852299b6..f77f8a0ff187 100644
--- a/arch/x86_64/kernel/kprobes.c
+++ b/arch/x86_64/kernel/kprobes.c
@@ -355,6 +355,13 @@ static void resume_execution(struct kprobe *p, struct pt_regs *regs)
                 *tos &= ~(TF_MASK | IF_MASK);
                 *tos |= kprobe_old_rflags;
                 break;
+        case 0xc3:              /* ret/lret */
+        case 0xcb:
+        case 0xc2:
+        case 0xca:
+                regs->eflags &= ~TF_MASK;
+                /* rip is already adjusted, no more changes required*/
+                return;
         case 0xe8:              /* call relative - Fix return addr */
                 *tos = orig_rip + (*tos - copy_rip);
                 break;
diff --git a/arch/x86_64/kernel/module.c b/arch/x86_64/kernel/module.c
index c2ffea8845ed..bac195c74bcc 100644
--- a/arch/x86_64/kernel/module.c
+++ b/arch/x86_64/kernel/module.c
@@ -30,9 +30,12 @@
 
 #define DEBUGP(fmt...) 
 
+#ifndef CONFIG_UML
 void module_free(struct module *mod, void *module_region)
 {
         vfree(module_region);
+        /* FIXME: If module_region == mod->init_region, trim exception
+           table entries. */
 }
 
 void *module_alloc(unsigned long size)
@@ -51,6 +54,7 @@ void *module_alloc(unsigned long size)
 
         return __vmalloc_area(area, GFP_KERNEL, PAGE_KERNEL_EXEC);
 }
+#endif
 
 /* We don't need anything special. */
 int module_frob_arch_sections(Elf_Ehdr *hdr,
diff --git a/arch/x86_64/kernel/mpparse.c b/arch/x86_64/kernel/mpparse.c
index 7ec031c6ca10..f86d9db94bfc 100644
--- a/arch/x86_64/kernel/mpparse.c
+++ b/arch/x86_64/kernel/mpparse.c
@@ -107,6 +107,7 @@ static int __init mpf_checksum(unsigned char *mp, int len)
 static void __init MP_processor_info (struct mpc_config_processor *m)
 {
         int ver;
+        static int found_bsp=0;
 
         if (!(m->mpc_cpuflag & CPU_ENABLED))
                 return;
@@ -126,11 +127,6 @@ static void __init MP_processor_info (struct mpc_config_processor *m)
                         " Processor ignored.\n", NR_CPUS);
                 return;
         }
-        if (num_processors >= maxcpus) {
-                printk(KERN_WARNING "WARNING: maxcpus limit of %i reached."
-                        " Processor ignored.\n", maxcpus);
-                return;
-        }
 
         num_processors++;
 
@@ -150,7 +146,19 @@ static void __init MP_processor_info (struct mpc_config_processor *m)
                 ver = 0x10;
         }
         apic_version[m->mpc_apicid] = ver;
-        bios_cpu_apicid[num_processors - 1] = m->mpc_apicid;
+        if (m->mpc_cpuflag & CPU_BOOTPROCESSOR) {
+                /*
+                 * bios_cpu_apicid is required to have processors listed
+                 * in same order as logical cpu numbers. Hence the first
+                 * entry is BSP, and so on.
+                 */
+                bios_cpu_apicid[0] = m->mpc_apicid;
+                x86_cpu_to_apicid[0] = m->mpc_apicid;
+                found_bsp = 1;
+        } else {
+                bios_cpu_apicid[num_processors - found_bsp] = m->mpc_apicid;
+                x86_cpu_to_apicid[num_processors - found_bsp] = m->mpc_apicid;
+        }
 }
 
 static void __init MP_bus_info (struct mpc_config_bus *m)
@@ -759,7 +767,7 @@ void __init mp_register_ioapic (
         mp_ioapics[idx].mpc_apicaddr = address;
 
         set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
-        mp_ioapics[idx].mpc_apicid = io_apic_get_unique_id(idx, id);
+        mp_ioapics[idx].mpc_apicid = id;
         mp_ioapics[idx].mpc_apicver = io_apic_get_version(idx);
         
         /* 
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 61de0b34a01e..31c0f2e6ac91 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -33,6 +33,7 @@
 #include <asm/msr.h>
 #include <asm/proto.h>
 #include <asm/kdebug.h>
+#include <asm/local.h>
 
 /*
  * lapic_nmi_owner tracks the ownership of the lapic NMI hardware:
@@ -59,7 +60,8 @@ int panic_on_timeout;
 
 unsigned int nmi_watchdog = NMI_DEFAULT;
 static unsigned int nmi_hz = HZ;
-unsigned int nmi_perfctr_msr;   /* the MSR to reset in NMI handler */
+static unsigned int nmi_perfctr_msr;    /* the MSR to reset in NMI handler */
+static unsigned int nmi_p4_cccr_val;
 
 /* Note that these events don't tick when the CPU idles. This means
    the frequency varies with CPU load. */
@@ -71,61 +73,87 @@ unsigned int nmi_perfctr_msr;	/* the MSR to reset in NMI handler */
 #define K7_EVENT_CYCLES_PROCESSOR_IS_RUNNING    0x76
 #define K7_NMI_EVENT            K7_EVENT_CYCLES_PROCESSOR_IS_RUNNING
 
-#define P6_EVNTSEL0_ENABLE      (1 << 22)
-#define P6_EVNTSEL_INT          (1 << 20)
-#define P6_EVNTSEL_OS           (1 << 17)
-#define P6_EVNTSEL_USR          (1 << 16)
-#define P6_EVENT_CPU_CLOCKS_NOT_HALTED  0x79
-#define P6_NMI_EVENT            P6_EVENT_CPU_CLOCKS_NOT_HALTED
+#define MSR_P4_MISC_ENABLE      0x1A0
+#define MSR_P4_MISC_ENABLE_PERF_AVAIL   (1<<7)
+#define MSR_P4_MISC_ENABLE_PEBS_UNAVAIL (1<<12)
+#define MSR_P4_PERFCTR0         0x300
+#define MSR_P4_CCCR0            0x360
+#define P4_ESCR_EVENT_SELECT(N) ((N)<<25)
+#define P4_ESCR_OS              (1<<3)
+#define P4_ESCR_USR             (1<<2)
+#define P4_CCCR_OVF_PMI0        (1<<26)
+#define P4_CCCR_OVF_PMI1        (1<<27)
+#define P4_CCCR_THRESHOLD(N)    ((N)<<20)
+#define P4_CCCR_COMPLEMENT      (1<<19)
+#define P4_CCCR_COMPARE         (1<<18)
+#define P4_CCCR_REQUIRED        (3<<16)
+#define P4_CCCR_ESCR_SELECT(N)  ((N)<<13)
+#define P4_CCCR_ENABLE          (1<<12)
+/* Set up IQ_COUNTER0 to behave like a clock, by having IQ_CCCR0 filter
+   CRU_ESCR0 (with any non-null event selector) through a complemented
+   max threshold. [IA32-Vol3, Section 14.9.9] */
+#define MSR_P4_IQ_COUNTER0      0x30C
+#define P4_NMI_CRU_ESCR0        (P4_ESCR_EVENT_SELECT(0x3F)|P4_ESCR_OS|P4_ESCR_USR)
+#define P4_NMI_IQ_CCCR0 \
+        (P4_CCCR_OVF_PMI0|P4_CCCR_THRESHOLD(15)|P4_CCCR_COMPLEMENT|     \
+         P4_CCCR_COMPARE|P4_CCCR_REQUIRED|P4_CCCR_ESCR_SELECT(4)|P4_CCCR_ENABLE)
+
+static __init inline int nmi_known_cpu(void)
+{
+        switch (boot_cpu_data.x86_vendor) {
+        case X86_VENDOR_AMD:
+                return boot_cpu_data.x86 == 15;
+        case X86_VENDOR_INTEL:
+                return boot_cpu_data.x86 == 15;
+        }
+        return 0;
+}
 
 /* Run after command line and cpu_init init, but before all other checks */
 void __init nmi_watchdog_default(void)
 {
         if (nmi_watchdog != NMI_DEFAULT)
                 return;
-
-        /* For some reason the IO APIC watchdog doesn't work on the AMD
-           8111 chipset. For now switch to local APIC mode using
-           perfctr0 there.  On Intel CPUs we don't have code to handle
-           the perfctr and the IO-APIC seems to work, so use that.  */
-
-        if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) {
-                nmi_watchdog = NMI_LOCAL_APIC; 
-                printk(KERN_INFO 
-              "Using local APIC NMI watchdog using perfctr0\n");
-        } else {
-                printk(KERN_INFO "Using IO APIC NMI watchdog\n");
+        if (nmi_known_cpu())
+                nmi_watchdog = NMI_LOCAL_APIC;
+        else
                 nmi_watchdog = NMI_IO_APIC;
-        }
 }
 
-/* Why is there no CPUID flag for this? */
-static __init int cpu_has_lapic(void)
+#ifdef CONFIG_SMP
+/* The performance counters used by NMI_LOCAL_APIC don't trigger when
+ * the CPU is idle. To make sure the NMI watchdog really ticks on all
+ * CPUs during the test make them busy.
+ */
+static __init void nmi_cpu_busy(void *data)
 {
-        switch (boot_cpu_data.x86_vendor) { 
-        case X86_VENDOR_INTEL:
-        case X86_VENDOR_AMD: 
-                return boot_cpu_data.x86 >= 6; 
-        /* .... add more cpus here or find a different way to figure this out. */       
-        default:
-                return 0;
-        }       
+        volatile int *endflag = data;
+        local_irq_enable();
+        /* Intentionally don't use cpu_relax here. This is
+           to make sure that the performance counter really ticks,
+           even if there is a simulator or similar that catches the
+           pause instruction. On a real HT machine this is fine because
+           all other CPUs are busy with "useless" delay loops and don't
+           care if they get somewhat less cycles. */
+        while (*endflag == 0)
+                barrier();
 }
+#endif
 
-static int __init check_nmi_watchdog (void)
+int __init check_nmi_watchdog (void)
 {
-        int counts[NR_CPUS];
+        volatile int endflag = 0;
+        int *counts;
         int cpu;
 
-        if (nmi_watchdog == NMI_NONE)
-                return 0;
+        counts = kmalloc(NR_CPUS * sizeof(int), GFP_KERNEL);
+        if (!counts)
+                return -1;
 
-        if (nmi_watchdog == NMI_LOCAL_APIC && !cpu_has_lapic())  {
-                nmi_watchdog = NMI_NONE;
-                return -1; 
-        }       
+        printk(KERN_INFO "testing NMI watchdog ... ");
 
-        printk(KERN_INFO "Testing NMI watchdog ... ");
+        if (nmi_watchdog == NMI_LOCAL_APIC)
+                smp_call_function(nmi_cpu_busy, (void *)&endflag, 0, 0);
 
         for (cpu = 0; cpu < NR_CPUS; cpu++)
                 counts[cpu] = cpu_pda[cpu].__nmi_count; 
@@ -133,15 +161,22 @@ static int __init check_nmi_watchdog (void)
         mdelay((10*1000)/nmi_hz); // wait 10 ticks
 
         for (cpu = 0; cpu < NR_CPUS; cpu++) {
+                if (!cpu_online(cpu))
+                        continue;
                 if (cpu_pda[cpu].__nmi_count - counts[cpu] <= 5) {
-                        printk("CPU#%d: NMI appears to be stuck (%d)!\n", 
+                        endflag = 1;
+                        printk("CPU#%d: NMI appears to be stuck (%d->%d)!\n",
                                cpu,
+                               counts[cpu],
                                cpu_pda[cpu].__nmi_count);
                         nmi_active = 0;
                         lapic_nmi_owner &= ~LAPIC_NMI_WATCHDOG;
+                        nmi_perfctr_msr = 0;
+                        kfree(counts);
                         return -1;
                 }
         }
+        endflag = 1;
         printk("OK.\n");
 
         /* now that we know it works we can reduce NMI frequency to
@@ -149,10 +184,9 @@ static int __init check_nmi_watchdog (void)
         if (nmi_watchdog == NMI_LOCAL_APIC)
                 nmi_hz = 1;
 
+        kfree(counts);
         return 0;
 }
-/* Have this called later during boot so counters are updating */
-late_initcall(check_nmi_watchdog);
 
 int __init setup_nmi_watchdog(char *str)
 {
@@ -170,7 +204,7 @@ int __init setup_nmi_watchdog(char *str)
 
         if (nmi >= NMI_INVALID)
                 return 0;
-                nmi_watchdog = nmi;
+        nmi_watchdog = nmi;
         return 1;
 }
 
@@ -185,7 +219,10 @@ static void disable_lapic_nmi_watchdog(void)
                 wrmsr(MSR_K7_EVNTSEL0, 0, 0);
                 break;
         case X86_VENDOR_INTEL:
-                wrmsr(MSR_IA32_EVNTSEL0, 0, 0);
+                if (boot_cpu_data.x86 == 15) {
+                        wrmsr(MSR_P4_IQ_CCCR0, 0, 0);
+                        wrmsr(MSR_P4_CRU_ESCR0, 0, 0);
+                }
                 break;
         }
         nmi_active = -1;
@@ -253,7 +290,7 @@ void enable_timer_nmi_watchdog(void)
 
 static int nmi_pm_active; /* nmi_active before suspend */
 
-static int lapic_nmi_suspend(struct sys_device *dev, pm_message_t state)
+static int lapic_nmi_suspend(struct sys_device *dev, u32 state)
 {
         nmi_pm_active = nmi_active;
         disable_lapic_nmi_watchdog();
@@ -300,22 +337,27 @@ late_initcall(init_lapic_nmi_sysfs);
  * Original code written by Keith Owens.
  */
 
+static void clear_msr_range(unsigned int base, unsigned int n)
+{
+        unsigned int i;
+
+        for(i = 0; i < n; ++i)
+                wrmsr(base+i, 0, 0);
+}
+
 static void setup_k7_watchdog(void)
 {
         int i;
         unsigned int evntsel;
 
-        /* No check, so can start with slow frequency */
-        nmi_hz = 1; 
-
-        /* XXX should check these in EFER */
-
         nmi_perfctr_msr = MSR_K7_PERFCTR0;
 
         for(i = 0; i < 4; ++i) {
                 /* Simulator may not support it */
-                if (checking_wrmsrl(MSR_K7_EVNTSEL0+i, 0UL))
+                if (checking_wrmsrl(MSR_K7_EVNTSEL0+i, 0UL)) {
+                        nmi_perfctr_msr = 0;
                         return;
+                }
                 wrmsrl(MSR_K7_PERFCTR0+i, 0UL);
         }
 
@@ -325,12 +367,54 @@ static void setup_k7_watchdog(void)
                 | K7_NMI_EVENT;
 
         wrmsr(MSR_K7_EVNTSEL0, evntsel, 0);
-        wrmsrl(MSR_K7_PERFCTR0, -((u64)cpu_khz*1000) / nmi_hz);
+        wrmsr(MSR_K7_PERFCTR0, -(cpu_khz/nmi_hz*1000), -1);
         apic_write(APIC_LVTPC, APIC_DM_NMI);
         evntsel |= K7_EVNTSEL_ENABLE;
         wrmsr(MSR_K7_EVNTSEL0, evntsel, 0);
 }
 
+
+static int setup_p4_watchdog(void)
+{
+        unsigned int misc_enable, dummy;
+
+        rdmsr(MSR_P4_MISC_ENABLE, misc_enable, dummy);
+        if (!(misc_enable & MSR_P4_MISC_ENABLE_PERF_AVAIL))
+                return 0;
+
+        nmi_perfctr_msr = MSR_P4_IQ_COUNTER0;
+        nmi_p4_cccr_val = P4_NMI_IQ_CCCR0;
+#ifdef CONFIG_SMP
+        if (smp_num_siblings == 2)
+                nmi_p4_cccr_val |= P4_CCCR_OVF_PMI1;
+#endif
+
+        if (!(misc_enable & MSR_P4_MISC_ENABLE_PEBS_UNAVAIL))
+                clear_msr_range(0x3F1, 2);
+        /* MSR 0x3F0 seems to have a default value of 0xFC00, but current
+           docs doesn't fully define it, so leave it alone for now. */
+        if (boot_cpu_data.x86_model >= 0x3) {
+                /* MSR_P4_IQ_ESCR0/1 (0x3ba/0x3bb) removed */
+                clear_msr_range(0x3A0, 26);
+                clear_msr_range(0x3BC, 3);
+        } else {
+                clear_msr_range(0x3A0, 31);
+        }
+        clear_msr_range(0x3C0, 6);
+        clear_msr_range(0x3C8, 6);
+        clear_msr_range(0x3E0, 2);
+        clear_msr_range(MSR_P4_CCCR0, 18);
+        clear_msr_range(MSR_P4_PERFCTR0, 18);
+
+        wrmsr(MSR_P4_CRU_ESCR0, P4_NMI_CRU_ESCR0, 0);
+        wrmsr(MSR_P4_IQ_CCCR0, P4_NMI_IQ_CCCR0 & ~P4_CCCR_ENABLE, 0);
+        Dprintk("setting P4_IQ_COUNTER0 to 0x%08lx\n", -(cpu_khz/nmi_hz*1000));
+        wrmsr(MSR_P4_IQ_COUNTER0, -(cpu_khz/nmi_hz*1000), -1);
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        wrmsr(MSR_P4_IQ_CCCR0, nmi_p4_cccr_val, 0);
+        return 1;
+}
+
 void setup_apic_nmi_watchdog(void)
 {
         switch (boot_cpu_data.x86_vendor) {
@@ -341,6 +425,13 @@ void setup_apic_nmi_watchdog(void)
                         return;
                 setup_k7_watchdog();
                 break;
+        case X86_VENDOR_INTEL:
+                if (boot_cpu_data.x86 != 15)
+                        return;
+                if (!setup_p4_watchdog())
+                        return;
+                break;
+
         default:
                 return;
         }
@@ -355,56 +446,67 @@ void setup_apic_nmi_watchdog(void)
  *
  * as these watchdog NMI IRQs are generated on every CPU, we only
  * have to check the current processor.
- *
- * since NMIs don't listen to _any_ locks, we have to be extremely
- * careful not to rely on unsafe variables. The printk might lock
- * up though, so we have to break up any console locks first ...
- * [when there will be more tty-related locks, break them up
- *  here too!]
  */
 
-static unsigned int
-        last_irq_sums [NR_CPUS],
-        alert_counter [NR_CPUS];
+static DEFINE_PER_CPU(unsigned, last_irq_sum);
+static DEFINE_PER_CPU(local_t, alert_counter);
+static DEFINE_PER_CPU(int, nmi_touch);
 
 void touch_nmi_watchdog (void)
 {
         int i;
 
         /*
-         * Just reset the alert counters, (other CPUs might be
-         * spinning on locks we hold):
+         * Tell other CPUs to reset their alert counters. We cannot
+         * do it ourselves because the alert count increase is not
+         * atomic.
          */
         for (i = 0; i < NR_CPUS; i++)
-                alert_counter[i] = 0;
+                per_cpu(nmi_touch, i) = 1;
 }
 
 void nmi_watchdog_tick (struct pt_regs * regs, unsigned reason)
 {
-        int sum, cpu;
+        int sum;
+        int touched = 0;
 
-        cpu = safe_smp_processor_id();
         sum = read_pda(apic_timer_irqs);
-        if (last_irq_sums[cpu] == sum) {
+        if (__get_cpu_var(nmi_touch)) {
+                __get_cpu_var(nmi_touch) = 0;
+                touched = 1;
+        }
+        if (!touched && __get_cpu_var(last_irq_sum) == sum) {
                 /*
                  * Ayiee, looks like this CPU is stuck ...
                  * wait a few IRQs (5 seconds) before doing the oops ...
                  */
-                alert_counter[cpu]++;
-                if (alert_counter[cpu] == 5*nmi_hz) {
+                local_inc(&__get_cpu_var(alert_counter));
+                if (local_read(&__get_cpu_var(alert_counter)) == 5*nmi_hz) {
                         if (notify_die(DIE_NMI, "nmi", regs, reason, 2, SIGINT)
                                                         == NOTIFY_STOP) {
-                                alert_counter[cpu] = 0; 
+                                local_set(&__get_cpu_var(alert_counter), 0);
                                 return;
                         } 
                         die_nmi("NMI Watchdog detected LOCKUP on CPU%d", regs);
                 }
         } else {
-                last_irq_sums[cpu] = sum;
-                alert_counter[cpu] = 0;
+                __get_cpu_var(last_irq_sum) = sum;
+                local_set(&__get_cpu_var(alert_counter), 0);
         }
-        if (nmi_perfctr_msr)
+        if (nmi_perfctr_msr) {
+                if (nmi_perfctr_msr == MSR_P4_IQ_COUNTER0) {
+                        /*
+                         * P4 quirks:
+                         * - An overflown perfctr will assert its interrupt
+                         *   until the OVF flag in its CCCR is cleared.
+                         * - LVTPC is masked on interrupt and must be
+                         *   unmasked by the LVTPC handler.
+                         */
+                        wrmsr(MSR_P4_IQ_CCCR0, nmi_p4_cccr_val, 0);
+                        apic_write(APIC_LVTPC, APIC_DM_NMI);
+                }
                 wrmsr(nmi_perfctr_msr, -(cpu_khz/nmi_hz*1000), -1);
+        }
 }
 
 static int dummy_nmi_callback(struct pt_regs * regs, int cpu)
diff --git a/arch/x86_64/kernel/pmtimer.c b/arch/x86_64/kernel/pmtimer.c
new file mode 100644
index 000000000000..feb5f108dd26
--- /dev/null
+++ b/arch/x86_64/kernel/pmtimer.c
@@ -0,0 +1,101 @@
+/* Ported over from i386 by AK, original copyright was:
+ *
+ * (C) Dominik Brodowski <linux@brodo.de> 2003
+ *
+ * Driver to use the Power Management Timer (PMTMR) available in some
+ * southbridges as primary timing source for the Linux kernel.
+ *
+ * Based on parts of linux/drivers/acpi/hardware/hwtimer.c, timer_pit.c,
+ * timer_hpet.c, and on Arjan van de Ven's implementation for 2.4.
+ *
+ * This file is licensed under the GPL v2.
+ *
+ * Dropped all the hardware bug workarounds for now. Hopefully they
+ * are not needed on 64bit chipsets.
+ */
+
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/time.h>
+#include <linux/init.h>
+#include <linux/cpumask.h>
+#include <asm/io.h>
+#include <asm/proto.h>
+#include <asm/msr.h>
+#include <asm/vsyscall.h>
+
+/* The I/O port the PMTMR resides at.
+ * The location is detected during setup_arch(),
+ * in arch/i386/kernel/acpi/boot.c */
+u32 pmtmr_ioport;
+
+/* value of the Power timer at last timer interrupt */
+static u32 offset_delay;
+static u32 last_pmtmr_tick;
+
+#define ACPI_PM_MASK 0xFFFFFF /* limit it to 24 bits */
+
+static inline u32 cyc2us(u32 cycles)
+{
+        /* The Power Management Timer ticks at 3.579545 ticks per microsecond.
+         * 1 / PM_TIMER_FREQUENCY == 0.27936511 =~ 286/1024 [error: 0.024%]
+         *
+         * Even with HZ = 100, delta is at maximum 35796 ticks, so it can
+         * easily be multiplied with 286 (=0x11E) without having to fear
+         * u32 overflows.
+         */
+        cycles *= 286;
+        return (cycles >> 10);
+}
+
+int pmtimer_mark_offset(void)
+{
+        static int first_run = 1;
+        unsigned long tsc;
+        u32 lost;
+
+        u32 tick = inl(pmtmr_ioport);
+        u32 delta;
+
+        delta = cyc2us((tick - last_pmtmr_tick) & ACPI_PM_MASK);
+
+        last_pmtmr_tick = tick;
+        monotonic_base += delta * NSEC_PER_USEC;
+
+        delta += offset_delay;
+
+        lost = delta / (USEC_PER_SEC / HZ);
+        offset_delay = delta % (USEC_PER_SEC / HZ);
+
+        rdtscll(tsc);
+        vxtime.last_tsc = tsc - offset_delay * cpu_khz;
+
+        /* don't calculate delay for first run,
+           or if we've got less then a tick */
+        if (first_run || (lost < 1)) {
+                first_run = 0;
+                offset_delay = 0;
+        }
+
+        return lost - 1;
+}
+
+unsigned int do_gettimeoffset_pm(void)
+{
+        u32 now, offset, delta = 0;
+
+        offset = last_pmtmr_tick;
+        now = inl(pmtmr_ioport);
+        delta = (now - offset) & ACPI_PM_MASK;
+
+        return offset_delay + cyc2us(delta);
+}
+
+
+static int __init nopmtimer_setup(char *s)
+{
+        pmtmr_ioport = 0;
+        return 0;
+}
+
+__setup("nopmtimer", nopmtimer_setup);
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c
index e26e86bb56fe..525f6a128a27 100644
--- a/arch/x86_64/kernel/ptrace.c
+++ b/arch/x86_64/kernel/ptrace.c
@@ -257,13 +257,13 @@ static int putreg(struct task_struct *child,
                         value &= 0xffff;
                         return 0;
                 case offsetof(struct user_regs_struct,fs_base):
-                        if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
-                                return -EIO; 
+                        if (value >= TASK_SIZE)
+                                return -EIO;
                         child->thread.fs = value;
                         return 0;
                 case offsetof(struct user_regs_struct,gs_base):
-                        if (!((value >> 48) == 0 || (value >> 48) == 0xffff))
-                                return -EIO; 
+                        if (value >= TASK_SIZE)
+                                return -EIO;
                         child->thread.gs = value;
                         return 0;
                 case offsetof(struct user_regs_struct, eflags):
@@ -277,6 +277,11 @@ static int putreg(struct task_struct *child,
                                 return -EIO;
                         value &= 0xffff;
                         break;
+                case offsetof(struct user_regs_struct, rip):
+                        /* Check if the new RIP address is canonical */
+                        if (value >= TASK_SIZE)
+                                return -EIO;
+                        break;
         }
         put_stack_long(child, regno - sizeof(struct pt_regs), value);
         return 0;
@@ -375,7 +380,7 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
                         break;
 
                 switch (addr) { 
-                case 0 ... sizeof(struct user_regs_struct):
+                case 0 ... sizeof(struct user_regs_struct) - sizeof(long):
                         tmp = getreg(child, addr);
                         break;
                 case offsetof(struct user, u_debugreg[0]):
@@ -420,7 +425,7 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
                         break;
 
                 switch (addr) { 
-                case 0 ... sizeof(struct user_regs_struct): 
+                case 0 ... sizeof(struct user_regs_struct) - sizeof(long):
                         ret = putreg(child, addr, data);
                         break;
                 /* Disallows to set a breakpoint into the vsyscall */
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 2129cf9ba6b2..99f038ede23c 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -719,7 +719,6 @@ static void __init display_cacheinfo(struct cpuinfo_x86 *c)
         }
 }
 
-#ifdef CONFIG_SMP
 /*
  * On a AMD dual core setup the lower bits of the APIC id distingush the cores.
  * Assumes number of cores is a power of two.
@@ -727,17 +726,26 @@ static void __init display_cacheinfo(struct cpuinfo_x86 *c)
 static void __init amd_detect_cmp(struct cpuinfo_x86 *c)
 {
 #ifdef CONFIG_SMP
-        int cpu = c->x86_apicid;
+        int cpu = smp_processor_id();
         int node = 0;
+        unsigned bits;
         if (c->x86_num_cores == 1)
                 return;
-        cpu_core_id[cpu] = cpu >> hweight32(c->x86_num_cores - 1);
+
+        bits = 0;
+        while ((1 << bits) < c->x86_num_cores)
+                bits++;
+
+        /* Low order bits define the core id (index of core in socket) */
+        cpu_core_id[cpu] = phys_proc_id[cpu] & ((1 << bits)-1);
+        /* Convert the APIC ID into the socket ID */
+        phys_proc_id[cpu] >>= bits;
 
 #ifdef CONFIG_NUMA
         /* When an ACPI SRAT table is available use the mappings from SRAT
            instead. */
         if (acpi_numa <= 0) {
-                node = cpu_core_id[cpu];
+                node = phys_proc_id[cpu];
                 if (!node_online(node))
                         node = first_node(node_online_map);
                 cpu_to_node[cpu] = node;
@@ -745,15 +753,11 @@ static void __init amd_detect_cmp(struct cpuinfo_x86 *c)
                 node = cpu_to_node[cpu];
         }
 #endif
+
         printk(KERN_INFO "CPU %d(%d) -> Node %d -> Core %d\n",
                         cpu, c->x86_num_cores, node, cpu_core_id[cpu]);
 #endif
 }
-#else
-static void __init amd_detect_cmp(struct cpuinfo_x86 *c)
-{
-}
-#endif
 
 static int __init init_amd(struct cpuinfo_x86 *c)
 {
@@ -925,7 +929,6 @@ void __init early_identify_cpu(struct cpuinfo_x86 *c)
         c->x86_clflush_size = 64;
         c->x86_cache_alignment = c->x86_clflush_size;
         c->x86_num_cores = 1;
-        c->x86_apicid = c == &boot_cpu_data ? 0 : c - cpu_data;
         c->extended_cpuid_level = 0;
         memset(&c->x86_capability, 0, sizeof c->x86_capability);
 
@@ -954,11 +957,14 @@ void __init early_identify_cpu(struct cpuinfo_x86 *c)
                 } 
                 if (c->x86_capability[0] & (1<<19)) 
                         c->x86_clflush_size = ((misc >> 8) & 0xff) * 8;
-                c->x86_apicid = misc >> 24;
         } else {
                 /* Have CPUID level 0 only - unheard of */
                 c->x86 = 4;
         }
+
+#ifdef CONFIG_SMP
+        phys_proc_id[smp_processor_id()] = (cpuid_ebx(1) >> 24) & 0xff;
+#endif
 }
 
 /*
@@ -1088,7 +1094,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 
                 /* Other (Linux-defined) */
-                "cxmmx", NULL, "cyrix_arr", "centaur_mcr", "k8c+",
+                "cxmmx", NULL, "cyrix_arr", "centaur_mcr", NULL,
                 "constant_tsc", NULL, NULL,
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
diff --git a/arch/x86_64/kernel/signal.c b/arch/x86_64/kernel/signal.c
index d439ced150c6..3fdcdba0fec5 100644
--- a/arch/x86_64/kernel/signal.c
+++ b/arch/x86_64/kernel/signal.c
@@ -452,7 +452,9 @@ int do_signal(struct pt_regs *regs, sigset_t *oldset)
                         regs->rip -= 2;
                 }
                 if (regs->rax == (unsigned long)-ERESTART_RESTARTBLOCK) {
-                        regs->rax = __NR_restart_syscall;
+                        regs->rax = test_thread_flag(TIF_IA32) ?
+                                        __NR_ia32_restart_syscall :
+                                        __NR_restart_syscall;
                         regs->rip -= 2;
                 }
         }
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index 73f7e8b9543a..f1ec0f345941 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -56,6 +56,7 @@
 #include <asm/kdebug.h>
 #include <asm/tlbflush.h>
 #include <asm/proto.h>
+#include <asm/nmi.h>
 
 /* Change for real CPU hotplug. Note other files need to be fixed
    first too. */
@@ -93,6 +94,7 @@ int smp_threads_ready;
 
 cpumask_t cpu_sibling_map[NR_CPUS] __cacheline_aligned;
 cpumask_t cpu_core_map[NR_CPUS] __cacheline_aligned;
+EXPORT_SYMBOL(cpu_core_map);
 
 /*
  * Trampoline 80x86 program as an array.
@@ -125,96 +127,210 @@ static void __cpuinit smp_store_cpu_info(int id)
 
         *c = boot_cpu_data;
         identify_cpu(c);
+        print_cpu_info(c);
 }
 
 /*
- * Synchronize TSCs of CPUs
+ * New Funky TSC sync algorithm borrowed from IA64.
+ * Main advantage is that it doesn't reset the TSCs fully and
+ * in general looks more robust and it works better than my earlier
+ * attempts. I believe it was written by David Mosberger. Some minor
+ * adjustments for x86-64 by me -AK
  *
- * This new algorithm is less accurate than the old "zero TSCs"
- * one, but we cannot zero TSCs anymore in the new hotplug CPU
- * model.
+ * Original comment reproduced below.
+ *
+ * Synchronize TSC of the current (slave) CPU with the TSC of the
+ * MASTER CPU (normally the time-keeper CPU).  We use a closed loop to
+ * eliminate the possibility of unaccounted-for errors (such as
+ * getting a machine check in the middle of a calibration step).  The
+ * basic idea is for the slave to ask the master what itc value it has
+ * and to read its own itc before and after the master responds.  Each
+ * iteration gives us three timestamps:
+ *
+ *      slave           master
+ *
+ *      t0 ---\
+ *             ---\
+ *                 --->
+ *                      tm
+ *                 /---
+ *             /---
+ *      t1 <---
+ *
+ *
+ * The goal is to adjust the slave's TSC such that tm falls exactly
+ * half-way between t0 and t1.  If we achieve this, the clocks are
+ * synchronized provided the interconnect between the slave and the
+ * master is symmetric.  Even if the interconnect were asymmetric, we
+ * would still know that the synchronization error is smaller than the
+ * roundtrip latency (t0 - t1).
+ *
+ * When the interconnect is quiet and symmetric, this lets us
+ * synchronize the TSC to within one or two cycles.  However, we can
+ * only *guarantee* that the synchronization is accurate to within a
+ * round-trip time, which is typically in the range of several hundred
+ * cycles (e.g., ~500 cycles).  In practice, this means that the TSCs
+ * are usually almost perfectly synchronized, but we shouldn't assume
+ * that the accuracy is much better than half a micro second or so.
+ *
+ * [there are other errors like the latency of RDTSC and of the
+ * WRMSR. These can also account to hundreds of cycles. So it's
+ * probably worse. It claims 153 cycles error on a dual Opteron,
+ * but I suspect the numbers are actually somewhat worse -AK]
  */
 
-static atomic_t __cpuinitdata tsc_flag;
+#define MASTER  0
+#define SLAVE   (SMP_CACHE_BYTES/8)
+
+/* Intentionally don't use cpu_relax() while TSC synchronization
+   because we don't want to go into funky power save modi or cause
+   hypervisors to schedule us away.  Going to sleep would likely affect
+   latency and low latency is the primary objective here. -AK */
+#define no_cpu_relax() barrier()
+
 static __cpuinitdata DEFINE_SPINLOCK(tsc_sync_lock);
-static unsigned long long __cpuinitdata bp_tsc, ap_tsc;
+static volatile __cpuinitdata unsigned long go[SLAVE + 1];
+static int notscsync __cpuinitdata;
+
+#undef DEBUG_TSC_SYNC
 
-#define NR_LOOPS 5
+#define NUM_ROUNDS      64      /* magic value */
+#define NUM_ITERS       5       /* likewise */
 
-static void __cpuinit sync_tsc_bp_init(int init)
+/* Callback on boot CPU */
+static __cpuinit void sync_master(void *arg)
 {
-        if (init)
-                _raw_spin_lock(&tsc_sync_lock);
-        else
-                _raw_spin_unlock(&tsc_sync_lock);
-        atomic_set(&tsc_flag, 0);
+        unsigned long flags, i;
+
+        if (smp_processor_id() != boot_cpu_id)
+                return;
+
+        go[MASTER] = 0;
+
+        local_irq_save(flags);
+        {
+                for (i = 0; i < NUM_ROUNDS*NUM_ITERS; ++i) {
+                        while (!go[MASTER])
+                                no_cpu_relax();
+                        go[MASTER] = 0;
+                        rdtscll(go[SLAVE]);
+                }
+        }
+        local_irq_restore(flags);
 }
 
 /*
- * Synchronize TSC on AP with BP.
+ * Return the number of cycles by which our tsc differs from the tsc
+ * on the master (time-keeper) CPU.  A positive number indicates our
+ * tsc is ahead of the master, negative that it is behind.
  */
-static void __cpuinit __sync_tsc_ap(void)
+static inline long
+get_delta(long *rt, long *master)
 {
-        if (!cpu_has_tsc)
-                return;
-        Dprintk("AP %d syncing TSC\n", smp_processor_id());
+        unsigned long best_t0 = 0, best_t1 = ~0UL, best_tm = 0;
+        unsigned long tcenter, t0, t1, tm;
+        int i;
 
-        while (atomic_read(&tsc_flag) != 0)
-                cpu_relax();
-        atomic_inc(&tsc_flag);
-        mb();
-        _raw_spin_lock(&tsc_sync_lock);
-        wrmsrl(MSR_IA32_TSC, bp_tsc);
-        _raw_spin_unlock(&tsc_sync_lock);
-        rdtscll(ap_tsc);
-        mb();
-        atomic_inc(&tsc_flag);
-        mb();
+        for (i = 0; i < NUM_ITERS; ++i) {
+                rdtscll(t0);
+                go[MASTER] = 1;
+                while (!(tm = go[SLAVE]))
+                        no_cpu_relax();
+                go[SLAVE] = 0;
+                rdtscll(t1);
+
+                if (t1 - t0 < best_t1 - best_t0)
+                        best_t0 = t0, best_t1 = t1, best_tm = tm;
+        }
+
+        *rt = best_t1 - best_t0;
+        *master = best_tm - best_t0;
+
+        /* average best_t0 and best_t1 without overflow: */
+        tcenter = (best_t0/2 + best_t1/2);
+        if (best_t0 % 2 + best_t1 % 2 == 2)
+                ++tcenter;
+        return tcenter - best_tm;
 }
 
-static void __cpuinit sync_tsc_ap(void)
+static __cpuinit void sync_tsc(void)
 {
-        int i;
-        for (i = 0; i < NR_LOOPS; i++)
-                __sync_tsc_ap();
+        int i, done = 0;
+        long delta, adj, adjust_latency = 0;
+        unsigned long flags, rt, master_time_stamp, bound;
+#if DEBUG_TSC_SYNC
+        static struct syncdebug {
+                long rt;        /* roundtrip time */
+                long master;    /* master's timestamp */
+                long diff;      /* difference between midpoint and master's timestamp */
+                long lat;       /* estimate of tsc adjustment latency */
+        } t[NUM_ROUNDS] __cpuinitdata;
+#endif
+
+        go[MASTER] = 1;
+
+        smp_call_function(sync_master, NULL, 1, 0);
+
+        while (go[MASTER])      /* wait for master to be ready */
+                no_cpu_relax();
+
+        spin_lock_irqsave(&tsc_sync_lock, flags);
+        {
+                for (i = 0; i < NUM_ROUNDS; ++i) {
+                        delta = get_delta(&rt, &master_time_stamp);
+                        if (delta == 0) {
+                                done = 1;       /* let's lock on to this... */
+                                bound = rt;
+                        }
+
+                        if (!done) {
+                                unsigned long t;
+                                if (i > 0) {
+                                        adjust_latency += -delta;
+                                        adj = -delta + adjust_latency/4;
+                                } else
+                                        adj = -delta;
+
+                                rdtscll(t);
+                                wrmsrl(MSR_IA32_TSC, t + adj);
+                        }
+#if DEBUG_TSC_SYNC
+                        t[i].rt = rt;
+                        t[i].master = master_time_stamp;
+                        t[i].diff = delta;
+                        t[i].lat = adjust_latency/4;
+#endif
+                }
+        }
+        spin_unlock_irqrestore(&tsc_sync_lock, flags);
+
+#if DEBUG_TSC_SYNC
+        for (i = 0; i < NUM_ROUNDS; ++i)
+                printk("rt=%5ld master=%5ld diff=%5ld adjlat=%5ld\n",
+                       t[i].rt, t[i].master, t[i].diff, t[i].lat);
+#endif
+
+        printk(KERN_INFO
+               "CPU %d: synchronized TSC with CPU %u (last diff %ld cycles, "
+               "maxerr %lu cycles)\n",
+               smp_processor_id(), boot_cpu_id, delta, rt);
 }
 
-/*
- * Synchronize TSC from BP to AP.
- */
-static void __cpuinit __sync_tsc_bp(int cpu)
+static void __cpuinit tsc_sync_wait(void)
 {
-        if (!cpu_has_tsc)
+        if (notscsync || !cpu_has_tsc)
                 return;
-
-        /* Wait for AP */
-        while (atomic_read(&tsc_flag) == 0)
-                cpu_relax();
-        /* Save BPs TSC */
-        sync_core();
-        rdtscll(bp_tsc);
-        /* Don't do the sync core here to avoid too much latency. */
-        mb();
-        /* Start the AP */
-        _raw_spin_unlock(&tsc_sync_lock);
-        /* Wait for AP again */
-        while (atomic_read(&tsc_flag) < 2)
-                cpu_relax();
-        rdtscl(bp_tsc);
-        barrier();
+        printk(KERN_INFO "CPU %d: Syncing TSC to CPU %u.\n", smp_processor_id(),
+                        boot_cpu_id);
+        sync_tsc();
 }
 
-static void __cpuinit sync_tsc_bp(int cpu)
+static __init int notscsync_setup(char *s)
 {
-        int i;
-        for (i = 0; i < NR_LOOPS - 1; i++) {
-                __sync_tsc_bp(cpu);
-                sync_tsc_bp_init(1);
-        }
-        __sync_tsc_bp(cpu);
-        printk(KERN_INFO "Synced TSC of CPU %d difference %Ld\n",
-               cpu, ap_tsc - bp_tsc);
+        notscsync = 1;
+        return 0;
 }
+__setup("notscsync", notscsync_setup);
 
 static atomic_t init_deasserted __cpuinitdata;
 
@@ -315,11 +431,6 @@ void __cpuinit start_secondary(void)
         cpu_init();
         smp_callin();
 
-        /*
-         * Synchronize the TSC with the BP
-         */
-        sync_tsc_ap();
-
         /* otherwise gcc will move up the smp_processor_id before the cpu_init */
         barrier();
 
@@ -334,7 +445,6 @@ void __cpuinit start_secondary(void)
                 enable_8259A_irq(0);
         }
 
-
         enable_APIC_timer();
 
         /*
@@ -343,6 +453,11 @@ void __cpuinit start_secondary(void)
         cpu_set(smp_processor_id(), cpu_online_map);
         mb();
 
+        /* Wait for TSC sync to not schedule things before.
+           We still process interrupts, which could see an inconsistent
+           time in that window unfortunately. */
+        tsc_sync_wait();
+
         cpu_idle();
 }
 
@@ -531,7 +646,6 @@ static int __cpuinit do_boot_cpu(int cpu, int apicid)
                 printk("failed fork for CPU %d\n", cpu);
                 return PTR_ERR(idle);
         }
-        x86_cpu_to_apicid[cpu] = apicid;
 
         cpu_pda[cpu].pcurrent = idle;
 
@@ -600,8 +714,6 @@ static int __cpuinit do_boot_cpu(int cpu, int apicid)
 
                 if (cpu_isset(cpu, cpu_callin_map)) {
                         /* number CPUs logically, starting from 1 (BSP is 0) */
-                        Dprintk("OK.\n");
-                        print_cpu_info(&cpu_data[cpu]);
                         Dprintk("CPU has booted.\n");
                 } else {
                         boot_error = 1;
@@ -842,7 +954,6 @@ void __cpuinit smp_prepare_cpus(unsigned int max_cpus)
                       GET_APIC_ID(apic_read(APIC_ID)), boot_cpu_id);
                 /* Or can we switch back to PIC here? */
         }
-        x86_cpu_to_apicid[0] = boot_cpu_id;
 
         /*
          * Now start the IO-APICs
@@ -889,18 +1000,14 @@ int __cpuinit __cpu_up(unsigned int cpu)
                 printk("__cpu_up: bad cpu %d\n", cpu);
                 return -EINVAL;
         }
-        sync_tsc_bp_init(1);
 
         /* Boot it! */
         err = do_boot_cpu(cpu, apicid);
         if (err < 0) {
-                sync_tsc_bp_init(0);
                 Dprintk("do_boot_cpu failed %d\n", err);
                 return err;
         }
 
-        sync_tsc_bp(cpu);
-
         /* Unleash the CPU! */
         Dprintk("waiting for cpu %d\n", cpu);
 
@@ -923,4 +1030,6 @@ void __cpuinit smp_cpus_done(unsigned int max_cpus)
 
         detect_siblings();
         time_init_gtod();
+
+        check_nmi_watchdog();
 }
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 0e3b60e1ac5b..735b6767c8ed 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -26,6 +26,8 @@
 #include <linux/sysdev.h>
 #include <linux/bcd.h>
 #include <linux/kallsyms.h>
+#include <linux/acpi.h>
+#include <acpi/achware.h>       /* for PM timer frequency */
 #include <asm/8253pit.h>
 #include <asm/pgtable.h>
 #include <asm/vsyscall.h>
@@ -396,6 +398,10 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                         (offset - vxtime.last)*(NSEC_PER_SEC/HZ) / hpet_tick;
 
                 vxtime.last = offset;
+#ifdef CONFIG_X86_PM_TIMER
+        } else if (vxtime.mode == VXTIME_PMTMR) {
+                lost = pmtimer_mark_offset();
+#endif
         } else {
                 offset = (((tsc - vxtime.last_tsc) *
                            vxtime.tsc_quot) >> 32) - (USEC_PER_SEC / HZ);
@@ -898,6 +904,13 @@ void __init time_init(void)
                         hpet_period;
                 cpu_khz = hpet_calibrate_tsc();
                 timename = "HPET";
+#ifdef CONFIG_X86_PM_TIMER
+        } else if (pmtmr_ioport) {
+                vxtime_hz = PM_TIMER_FREQUENCY;
+                timename = "PM";
+                pit_init();
+                cpu_khz = pit_calibrate_tsc();
+#endif
         } else {
                 pit_init();
                 cpu_khz = pit_calibrate_tsc();
@@ -923,35 +936,50 @@ void __init time_init(void)
 }
 
 /*
+ * Make an educated guess if the TSC is trustworthy and synchronized
+ * over all CPUs.
+ */
+static __init int unsynchronized_tsc(void)
+{
+#ifdef CONFIG_SMP
+        if (oem_force_hpet_timer())
+                return 1;
+        /* Intel systems are normally all synchronized. Exceptions
+           are handled in the OEM check above. */
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
+                return 0;
+        /* All in a single socket - should be synchronized */
+        if (cpus_weight(cpu_core_map[0]) == num_online_cpus())
+                return 0;
+#endif
+        /* Assume multi socket systems are not synchronized */
+        return num_online_cpus() > 1;
+}
+
+/*
  * Decide after all CPUs are booted what mode gettimeofday should use.
  */
 void __init time_init_gtod(void)
 {
         char *timetype;
 
-        /*
-         * AMD systems with more than one CPU don't have fully synchronized
-         * TSCs. Always use HPET gettimeofday for these, although it is slower.
-         * Intel SMP systems usually have synchronized TSCs, so use always
-         * the TSC.
-         *
-         * Exceptions:
-         * IBM Summit2 checked by oem_force_hpet_timer().
-         * AMD dual core may also not need HPET. Check me.
-         *
-         * Can be turned off with "notsc".
-         */
-        if (num_online_cpus() > 1 &&
-            boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
-                notsc = 1;
-        /* Some systems will want to disable TSC and use HPET. */
-        if (oem_force_hpet_timer())
+        if (unsynchronized_tsc())
                 notsc = 1;
         if (vxtime.hpet_address && notsc) {
                 timetype = "HPET";
                 vxtime.last = hpet_readl(HPET_T0_CMP) - hpet_tick;
                 vxtime.mode = VXTIME_HPET;
                 do_gettimeoffset = do_gettimeoffset_hpet;
+#ifdef CONFIG_X86_PM_TIMER
+        /* Using PM for gettimeofday is quite slow, but we have no other
+           choice because the TSC is too unreliable on some systems. */
+        } else if (pmtmr_ioport && !vxtime.hpet_address && notsc) {
+                timetype = "PM";
+                do_gettimeoffset = do_gettimeoffset_pm;
+                vxtime.mode = VXTIME_PMTMR;
+                sysctl_vsyscall = 0;
+                printk(KERN_INFO "Disabling vsyscall due to use of PM timer\n");
+#endif
         } else {
                 timetype = vxtime.hpet_address ? "HPET/TSC" : "PIT/TSC";
                 vxtime.mode = VXTIME_TSC;
diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c
index b4b8dc59663a..2e5734425949 100644
--- a/arch/x86_64/kernel/vsyscall.c
+++ b/arch/x86_64/kernel/vsyscall.c
@@ -65,7 +65,7 @@ static force_inline void do_vgettimeofday(struct timeval * tv)
                 usec = (__xtime.tv_nsec / 1000) +
                         (__jiffies - __wall_jiffies) * (1000000 / HZ);
 
-                if (__vxtime.mode == VXTIME_TSC) {
+                if (__vxtime.mode != VXTIME_HPET) {
                         sync_core();
                         rdtscll(t);
                         if (t < __vxtime.last_tsc)
@@ -217,8 +217,9 @@ static int __init vsyscall_init(void)
         BUG_ON((unsigned long) &vtime != VSYSCALL_ADDR(__NR_vtime));
         BUG_ON((VSYSCALL_ADDR(0) != __fix_to_virt(VSYSCALL_FIRST_PAGE)));
         map_vsyscall();
-        sysctl_vsyscall = 1;
+#ifdef CONFIG_SYSCTL
         register_sysctl_table(kernel_root_table2, 0);
+#endif
         return 0;
 }
 
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index 88626e626886..a43dedb58fa2 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -139,35 +139,23 @@ EXPORT_SYMBOL_GPL(unset_nmi_callback);
 #undef memmove
 #undef memchr
 #undef strlen
-#undef strcpy
 #undef strncmp
 #undef strncpy
 #undef strchr   
-#undef strcmp 
-#undef strcpy 
-#undef strcat
-#undef memcmp
 
 extern void * memset(void *,int,__kernel_size_t);
 extern size_t strlen(const char *);
 extern void * memmove(void * dest,const void *src,size_t count);
-extern char * strcpy(char * dest,const char *src);
-extern int strcmp(const char * cs,const char * ct);
 extern void *memchr(const void *s, int c, size_t n);
 extern void * memcpy(void *,const void *,__kernel_size_t);
 extern void * __memcpy(void *,const void *,__kernel_size_t);
-extern char * strcat(char *, const char *);
-extern int memcmp(const void * cs,const void * ct,size_t count);
 
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(strlen);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strcat);
 EXPORT_SYMBOL(strncat);
 EXPORT_SYMBOL(memchr);
 EXPORT_SYMBOL(strrchr);
@@ -175,7 +163,6 @@ EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(__memcpy);
-EXPORT_SYMBOL(memcmp);
 
 #ifdef CONFIG_RWSEM_XCHGADD_ALGORITHM
 /* prototypes are wrong, these are assembly with custom calling functions */
diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
index e03309216764..5d6b2114cc9a 100644
--- a/arch/x86_64/mm/fault.c
+++ b/arch/x86_64/mm/fault.c
@@ -234,6 +234,8 @@ static noinline void pgtable_bad(unsigned long address, struct pt_regs *regs,
 
 /*
  * Handle a fault on the vmalloc or module mapping area
+ *
+ * This assumes no large pages in there.
  */
 static int vmalloc_fault(unsigned long address)
 {
@@ -272,7 +274,10 @@ static int vmalloc_fault(unsigned long address)
         if (!pte_present(*pte_ref))
                 return -1;
         pte = pte_offset_kernel(pmd, address);
-        if (!pte_present(*pte) || pte_page(*pte) != pte_page(*pte_ref))
+        /* Don't use pte_page here, because the mappings can point
+           outside mem_map, and the NUMA hash lookup cannot handle
+           that. */
+        if (!pte_present(*pte) || pte_pfn(*pte) != pte_pfn(*pte_ref))
                 BUG();
         __flush_tlb_all();
         return 0;
@@ -346,7 +351,9 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code)
          * protection error (error_code & 1) == 0.
          */
         if (unlikely(address >= TASK_SIZE)) {
-                if (!(error_code & 5)) {
+                if (!(error_code & 5) &&
+                      ((address >= VMALLOC_START && address < VMALLOC_END) ||
+                       (address >= MODULES_VADDR && address < MODULES_END))) {
                         if (vmalloc_fault(address) < 0)
                                 goto bad_area_nosemaphore;
                         return;
diff --git a/arch/x86_64/mm/ioremap.c b/arch/x86_64/mm/ioremap.c
index 74ec8554b195..58aac23760ef 100644
--- a/arch/x86_64/mm/ioremap.c
+++ b/arch/x86_64/mm/ioremap.c
@@ -133,7 +133,7 @@ ioremap_change_attr(unsigned long phys_addr, unsigned long size,
                                         unsigned long flags)
 {
         int err = 0;
-        if (flags && phys_addr + size - 1 < (end_pfn_map << PAGE_SHIFT)) {
+        if (phys_addr + size - 1 < (end_pfn_map << PAGE_SHIFT)) {
                 unsigned long npages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
                 unsigned long vaddr = (unsigned long) __va(phys_addr);
 
@@ -214,7 +214,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
                 remove_vm_area((void *)(PAGE_MASK & (unsigned long) addr));
                 return NULL;
         }
-        if (ioremap_change_attr(phys_addr, size, flags) < 0) {
+        if (flags && ioremap_change_attr(phys_addr, size, flags) < 0) {
                 area->flags &= 0xffffff;
                 vunmap(addr);
                 return NULL;
@@ -251,7 +251,7 @@ void __iomem *ioremap_nocache (unsigned long phys_addr, unsigned long size)
 
 void iounmap(volatile void __iomem *addr)
 {
-        struct vm_struct *p, **pprev;
+        struct vm_struct *p;
 
         if (addr <= high_memory) 
                 return; 
@@ -260,24 +260,11 @@ void iounmap(volatile void __iomem *addr)
                 return;
 
         write_lock(&vmlist_lock);
-        for (p = vmlist, pprev = &vmlist; p != NULL; pprev = &p->next, p = *pprev)
-                if (p->addr == (void *)(PAGE_MASK & (unsigned long)addr))
-                        break;
-        if (!p) { 
-                printk("__iounmap: bad address %p\n", addr);
-                goto out_unlock;
-        }
-        *pprev = p->next;
-        unmap_vm_area(p);
-        if ((p->flags >> 20) &&
-                p->phys_addr + p->size - 1 < virt_to_phys(high_memory)) {
-                /* p->size includes the guard page, but cpa doesn't like that */
-                change_page_attr(virt_to_page(__va(p->phys_addr)),
-                                 p->size >> PAGE_SHIFT,
-                                 PAGE_KERNEL);
-                global_flush_tlb();
-        } 
-out_unlock:
+        p = __remove_vm_area((void *)((unsigned long)addr & PAGE_MASK));
+        if (!p)
+                printk("iounmap: bad address %p\n", addr);
+        else if (p->flags >> 20)
+                ioremap_change_attr(p->phys_addr, p->size, 0);
         write_unlock(&vmlist_lock);
         kfree(p); 
 }
diff --git a/crypto/crypto_null.c b/crypto/crypto_null.c
index f691d31fa9ee..3fcf6e887e87 100644
--- a/crypto/crypto_null.c
+++ b/crypto/crypto_null.c
@@ -21,6 +21,7 @@
 #include <linux/mm.h>
 #include <asm/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/string.h>
 
 #define NULL_KEY_SIZE           0
 #define NULL_BLOCK_SIZE         1
@@ -28,11 +29,13 @@
 
 static int null_compress(void *ctx, const u8 *src, unsigned int slen,
                          u8 *dst, unsigned int *dlen)
-{ return 0; }
-
-static int null_decompress(void *ctx, const u8 *src, unsigned int slen,
-                           u8 *dst, unsigned int *dlen)
-{ return 0; }
+{
+        if (slen > *dlen)
+                return -EINVAL;
+        memcpy(dst, src, slen);
+        *dlen = slen;
+        return 0;
+}
 
 static void null_init(void *ctx)
 { }
@@ -47,11 +50,10 @@ static int null_setkey(void *ctx, const u8 *key,
                        unsigned int keylen, u32 *flags)
 { return 0; }
 
-static void null_encrypt(void *ctx, u8 *dst, const u8 *src)
-{ }
-
-static void null_decrypt(void *ctx, u8 *dst, const u8 *src)
-{ }
+static void null_crypt(void *ctx, u8 *dst, const u8 *src)
+{
+        memcpy(dst, src, NULL_BLOCK_SIZE);
+}
 
 static struct crypto_alg compress_null = {
         .cra_name               =       "compress_null",
@@ -62,7 +64,7 @@ static struct crypto_alg compress_null = {
         .cra_list               =       LIST_HEAD_INIT(compress_null.cra_list),
         .cra_u                  =       { .compress = {
         .coa_compress           =       null_compress,
-        .coa_decompress         =       null_decompress } }
+        .coa_decompress         =       null_compress } }
 };
 
 static struct crypto_alg digest_null = {
@@ -90,8 +92,8 @@ static struct crypto_alg cipher_null = {
         .cia_min_keysize        =       NULL_KEY_SIZE,
         .cia_max_keysize        =       NULL_KEY_SIZE,
         .cia_setkey             =       null_setkey,
-        .cia_encrypt            =       null_encrypt,
-        .cia_decrypt            =       null_decrypt } }
+        .cia_encrypt            =       null_crypt,
+        .cia_decrypt            =       null_crypt } }
 };
 
 MODULE_ALIAS("compress_null");
diff --git a/drivers/base/Makefile b/drivers/base/Makefile
index 6662b545e0a9..a47928a2e575 100644
--- a/drivers/base/Makefile
+++ b/drivers/base/Makefile
@@ -1,6 +1,6 @@
 # Makefile for the Linux device tree
 
-obj-y                   := core.o sys.o interface.o bus.o \
+obj-y                   := core.o sys.o bus.o \
                            driver.o class.o class_simple.o platform.o \
                            cpu.o firmware.o init.o map.o dmapool.o \
                            attribute_container.o transport_class.o
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 2b3902c867da..3cb04bb04c2b 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -390,7 +390,6 @@ void device_release_driver(struct device * dev)
                 sysfs_remove_link(&drv->kobj, kobject_name(&dev->kobj));
                 sysfs_remove_link(&dev->kobj, "driver");
                 list_del_init(&dev->driver_list);
-                device_detach_shutdown(dev);
                 if (drv->remove)
                         drv->remove(dev);
                 dev->driver = NULL;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 268a9c8d168b..d21eb7744496 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -31,8 +31,6 @@ int (*platform_notify_remove)(struct device * dev) = NULL;
 #define to_dev(obj) container_of(obj, struct device, kobj)
 #define to_dev_attr(_attr) container_of(_attr, struct device_attribute, attr)
 
-extern struct attribute * dev_default_attrs[];
-
 static ssize_t
 dev_attr_show(struct kobject * kobj, struct attribute * attr, char * buf)
 {
@@ -89,7 +87,6 @@ static void device_release(struct kobject * kobj)
 static struct kobj_type ktype_device = {
         .release        = device_release,
         .sysfs_ops      = &dev_sysfs_ops,
-        .default_attrs  = dev_default_attrs,
 };
 
 
diff --git a/drivers/base/interface.c b/drivers/base/interface.c
deleted file mode 100644
index bd515843a0cb..000000000000
--- a/drivers/base/interface.c
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * drivers/base/interface.c - common driverfs interface that's exported to
- *      the world for all devices.
- *
- * Copyright (c) 2002-3 Patrick Mochel
- * Copyright (c) 2002-3 Open Source Development Labs
- *
- * This file is released under the GPLv2
- *
- */
-
-#include <linux/device.h>
-#include <linux/err.h>
-#include <linux/stat.h>
-#include <linux/string.h>
-
-/**
- *      detach_state - control the default power state for the device.
- *
- *      This is the state the device enters when it's driver module is
- *      unloaded. The value is an unsigned integer, in the range of 0-4.
- *      '0' indicates 'On', so no action will be taken when the driver is
- *      unloaded. This is the default behavior.
- *      '4' indicates 'Off', meaning the driver core will call the driver's
- *      shutdown method to quiesce the device.
- *      1-3 indicate a low-power state for the device to enter via the
- *      driver's suspend method.
- */
-
-static ssize_t detach_show(struct device * dev, char * buf)
-{
-        return sprintf(buf, "%u\n", dev->detach_state);
-}
-
-static ssize_t detach_store(struct device * dev, const char * buf, size_t n)
-{
-        u32 state;
-        state = simple_strtoul(buf, NULL, 10);
-        if (state > 4)
-                return -EINVAL;
-        dev->detach_state = state;
-        return n;
-}
-
-static DEVICE_ATTR(detach_state, 0644, detach_show, detach_store);
-
-
-struct attribute * dev_default_attrs[] = {
-        &dev_attr_detach_state.attr,
-        NULL,
-};
diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
index e5eda746f2a6..2e700d795cf1 100644
--- a/drivers/base/power/power.h
+++ b/drivers/base/power/power.h
@@ -1,18 +1,7 @@
-
-
-enum {
-        DEVICE_PM_ON,
-        DEVICE_PM1,
-        DEVICE_PM2,
-        DEVICE_PM3,
-        DEVICE_PM_OFF,
-};
-
 /*
  * shutdown.c
  */
 
-extern int device_detach_shutdown(struct device *);
 extern void device_shutdown(void);
 
 
diff --git a/drivers/base/power/resume.c b/drivers/base/power/resume.c
index f8f5055754d6..26468971ef5a 100644
--- a/drivers/base/power/resume.c
+++ b/drivers/base/power/resume.c
@@ -22,8 +22,17 @@ extern int sysdev_resume(void);
 
 int resume_device(struct device * dev)
 {
-        if (dev->bus && dev->bus->resume)
+        if (dev->power.pm_parent
+                        && dev->power.pm_parent->power.power_state) {
+                dev_err(dev, "PM: resume from %d, parent %s still %d\n",
+                        dev->power.power_state,
+                        dev->power.pm_parent->bus_id,
+                        dev->power.pm_parent->power.power_state);
+        }
+        if (dev->bus && dev->bus->resume) {
+                dev_dbg(dev,"resuming\n");
                 return dev->bus->resume(dev);
+        }
         return 0;
 }
 
diff --git a/drivers/base/power/shutdown.c b/drivers/base/power/shutdown.c
index d1e023fbe169..f50a08be424b 100644
--- a/drivers/base/power/shutdown.c
+++ b/drivers/base/power/shutdown.c
@@ -19,20 +19,6 @@
 extern struct subsystem devices_subsys;
 
 
-int device_detach_shutdown(struct device * dev)
-{
-        if (!dev->detach_state)
-                return 0;
-
-        if (dev->detach_state == DEVICE_PM_OFF) {
-                if (dev->driver && dev->driver->shutdown)
-                        dev->driver->shutdown(dev);
-                return 0;
-        }
-        return dpm_runtime_suspend(dev, dev->detach_state);
-}
-
-
 /**
  * We handle system devices differently - we suspend and shut them
  * down last and resume them first. That way, we don't do anything stupid like
@@ -52,13 +38,12 @@ void device_shutdown(void)
         struct device * dev;
 
         down_write(&devices_subsys.rwsem);
-        list_for_each_entry_reverse(dev, &devices_subsys.kset.list, kobj.entry) {
-                pr_debug("shutting down %s: ", dev->bus_id);
+        list_for_each_entry_reverse(dev, &devices_subsys.kset.list,
+                                kobj.entry) {
                 if (dev->driver && dev->driver->shutdown) {
-                        pr_debug("Ok\n");
+                        dev_dbg(dev, "shutdown\n");
                         dev->driver->shutdown(dev);
-                } else
-                        pr_debug("Ignored.\n");
+                }
         }
         up_write(&devices_subsys.rwsem);
 
diff --git a/drivers/base/power/suspend.c b/drivers/base/power/suspend.c
index a0b5cf689e63..0ec44ef840be 100644
--- a/drivers/base/power/suspend.c
+++ b/drivers/base/power/suspend.c
@@ -39,12 +39,25 @@ int suspend_device(struct device * dev, pm_message_t state)
 {
         int error = 0;
 
-        dev_dbg(dev, "suspending\n");
+        if (dev->power.power_state) {
+                dev_dbg(dev, "PM: suspend %d-->%d\n",
+                        dev->power.power_state, state);
+        }
+        if (dev->power.pm_parent
+                        && dev->power.pm_parent->power.power_state) {
+                dev_err(dev,
+                        "PM: suspend %d->%d, parent %s already %d\n",
+                        dev->power.power_state, state,
+                        dev->power.pm_parent->bus_id,
+                        dev->power.pm_parent->power.power_state);
+        }
 
         dev->power.prev_state = dev->power.power_state;
 
-        if (dev->bus && dev->bus->suspend && !dev->power.power_state)
+        if (dev->bus && dev->bus->suspend && !dev->power.power_state) {
+                dev_dbg(dev, "suspending\n");
                 error = dev->bus->suspend(dev, state);
+        }
 
         return error;
 }
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 423bbf2000d2..3760edfdc65c 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -3,6 +3,7 @@
   Linux Driver for Mylex DAC960/AcceleRAID/eXtremeRAID PCI RAID Controllers
 
   Copyright 1998-2001 by Leonard N. Zubkoff <lnz@dandelion.com>
+  Portions Copyright 2002 by Mylex (An IBM Business Unit)
 
   This program is free software; you may redistribute and/or modify it under
   the terms of the GNU General Public License Version 2 as published by the
@@ -532,6 +533,34 @@ static void DAC960_WaitForCommand(DAC960_Controller_T *Controller)
   spin_lock_irq(&Controller->queue_lock);
 }
 
+/*
+  DAC960_GEM_QueueCommand queues Command for DAC960 GEM Series Controllers.
+*/
+
+static void DAC960_GEM_QueueCommand(DAC960_Command_T *Command)
+{
+  DAC960_Controller_T *Controller = Command->Controller;
+  void __iomem *ControllerBaseAddress = Controller->BaseAddress;
+  DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
+  DAC960_V2_CommandMailbox_T *NextCommandMailbox =
+      Controller->V2.NextCommandMailbox;
+
+  CommandMailbox->Common.CommandIdentifier = Command->CommandIdentifier;
+  DAC960_GEM_WriteCommandMailbox(NextCommandMailbox, CommandMailbox);
+
+  if (Controller->V2.PreviousCommandMailbox1->Words[0] == 0 ||
+      Controller->V2.PreviousCommandMailbox2->Words[0] == 0)
+      DAC960_GEM_MemoryMailboxNewCommand(ControllerBaseAddress);
+
+  Controller->V2.PreviousCommandMailbox2 =
+      Controller->V2.PreviousCommandMailbox1;
+  Controller->V2.PreviousCommandMailbox1 = NextCommandMailbox;
+
+  if (++NextCommandMailbox > Controller->V2.LastCommandMailbox)
+      NextCommandMailbox = Controller->V2.FirstCommandMailbox;
+
+  Controller->V2.NextCommandMailbox = NextCommandMailbox;
+}
 
 /*
   DAC960_BA_QueueCommand queues Command for DAC960 BA Series Controllers.
@@ -1464,6 +1493,17 @@ static boolean DAC960_V2_EnableMemoryMailboxInterface(DAC960_Controller_T
                                         Controller->V2.FirstStatusMailboxDMA;
   switch (Controller->HardwareType)
     {
+    case DAC960_GEM_Controller:
+      while (DAC960_GEM_HardwareMailboxFullP(ControllerBaseAddress))
+        udelay(1);
+      DAC960_GEM_WriteHardwareMailbox(ControllerBaseAddress, CommandMailboxDMA);
+      DAC960_GEM_HardwareMailboxNewCommand(ControllerBaseAddress);
+      while (!DAC960_GEM_HardwareMailboxStatusAvailableP(ControllerBaseAddress))
+        udelay(1);
+      CommandStatus = DAC960_GEM_ReadCommandStatus(ControllerBaseAddress);
+      DAC960_GEM_AcknowledgeHardwareMailboxInterrupt(ControllerBaseAddress);
+      DAC960_GEM_AcknowledgeHardwareMailboxStatus(ControllerBaseAddress);
+      break;
     case DAC960_BA_Controller:
       while (DAC960_BA_HardwareMailboxFullP(ControllerBaseAddress))
         udelay(1);
@@ -2627,6 +2667,9 @@ static void DAC960_DetectCleanup(DAC960_Controller_T *Controller)
   if (Controller->MemoryMappedAddress) {
         switch(Controller->HardwareType)
         {
+                case DAC960_GEM_Controller:
+                        DAC960_GEM_DisableInterrupts(Controller->BaseAddress);
+                        break;
                 case DAC960_BA_Controller:
                         DAC960_BA_DisableInterrupts(Controller->BaseAddress);
                         break;
@@ -2705,6 +2748,9 @@ DAC960_DetectController(struct pci_dev *PCI_Device,
 
   switch (Controller->HardwareType)
   {
+        case DAC960_GEM_Controller:
+          Controller->PCI_Address = pci_resource_start(PCI_Device, 0);
+          break;
         case DAC960_BA_Controller:
           Controller->PCI_Address = pci_resource_start(PCI_Device, 0);
           break;
@@ -2756,6 +2802,36 @@ DAC960_DetectController(struct pci_dev *PCI_Device,
   BaseAddress = Controller->BaseAddress;
   switch (Controller->HardwareType)
   {
+        case DAC960_GEM_Controller:
+          DAC960_GEM_DisableInterrupts(BaseAddress);
+          DAC960_GEM_AcknowledgeHardwareMailboxStatus(BaseAddress);
+          udelay(1000);
+          while (DAC960_GEM_InitializationInProgressP(BaseAddress))
+            {
+              if (DAC960_GEM_ReadErrorStatus(BaseAddress, &ErrorStatus,
+                                            &Parameter0, &Parameter1) &&
+                  DAC960_ReportErrorStatus(Controller, ErrorStatus,
+                                           Parameter0, Parameter1))
+                goto Failure;
+              udelay(10);
+            }
+          if (!DAC960_V2_EnableMemoryMailboxInterface(Controller))
+            {
+              DAC960_Error("Unable to Enable Memory Mailbox Interface "
+                           "for Controller at\n", Controller);
+              goto Failure;
+            }
+          DAC960_GEM_EnableInterrupts(BaseAddress);
+          Controller->QueueCommand = DAC960_GEM_QueueCommand;
+          Controller->ReadControllerConfiguration =
+            DAC960_V2_ReadControllerConfiguration;
+          Controller->ReadDeviceConfiguration =
+            DAC960_V2_ReadDeviceConfiguration;
+          Controller->ReportDeviceConfiguration =
+            DAC960_V2_ReportDeviceConfiguration;
+          Controller->QueueReadWriteCommand =
+            DAC960_V2_QueueReadWriteCommand;
+          break;
         case DAC960_BA_Controller:
           DAC960_BA_DisableInterrupts(BaseAddress);
           DAC960_BA_AcknowledgeHardwareMailboxStatus(BaseAddress);
@@ -5189,6 +5265,47 @@ static void DAC960_V2_ProcessCompletedCommand(DAC960_Command_T *Command)
   wake_up(&Controller->CommandWaitQueue);
 }
 
+/*
+  DAC960_GEM_InterruptHandler handles hardware interrupts from DAC960 GEM Series
+  Controllers.
+*/
+
+static irqreturn_t DAC960_GEM_InterruptHandler(int IRQ_Channel,
+                                       void *DeviceIdentifier,
+                                       struct pt_regs *InterruptRegisters)
+{
+  DAC960_Controller_T *Controller = (DAC960_Controller_T *) DeviceIdentifier;
+  void __iomem *ControllerBaseAddress = Controller->BaseAddress;
+  DAC960_V2_StatusMailbox_T *NextStatusMailbox;
+  unsigned long flags;
+
+  spin_lock_irqsave(&Controller->queue_lock, flags);
+  DAC960_GEM_AcknowledgeInterrupt(ControllerBaseAddress);
+  NextStatusMailbox = Controller->V2.NextStatusMailbox;
+  while (NextStatusMailbox->Fields.CommandIdentifier > 0)
+    {
+       DAC960_V2_CommandIdentifier_T CommandIdentifier =
+           NextStatusMailbox->Fields.CommandIdentifier;
+       DAC960_Command_T *Command = Controller->Commands[CommandIdentifier-1];
+       Command->V2.CommandStatus = NextStatusMailbox->Fields.CommandStatus;
+       Command->V2.RequestSenseLength =
+           NextStatusMailbox->Fields.RequestSenseLength;
+       Command->V2.DataTransferResidue =
+           NextStatusMailbox->Fields.DataTransferResidue;
+       NextStatusMailbox->Words[0] = 0;
+       if (++NextStatusMailbox > Controller->V2.LastStatusMailbox)
+           NextStatusMailbox = Controller->V2.FirstStatusMailbox;
+       DAC960_V2_ProcessCompletedCommand(Command);
+    }
+  Controller->V2.NextStatusMailbox = NextStatusMailbox;
+  /*
+    Attempt to remove additional I/O Requests from the Controller's
+    I/O Request Queue and queue them to the Controller.
+  */
+  DAC960_ProcessRequest(Controller);
+  spin_unlock_irqrestore(&Controller->queue_lock, flags);
+  return IRQ_HANDLED;
+}
 
 /*
   DAC960_BA_InterruptHandler handles hardware interrupts from DAC960 BA Series
@@ -6962,6 +7079,14 @@ static void DAC960_gam_cleanup(void)
 
 #endif /* DAC960_GAM_MINOR */
 
+static struct DAC960_privdata DAC960_GEM_privdata = {
+        .HardwareType =         DAC960_GEM_Controller,
+        .FirmwareType   =       DAC960_V2_Controller,
+        .InterruptHandler =     DAC960_GEM_InterruptHandler,
+        .MemoryWindowSize =     DAC960_GEM_RegisterWindowSize,
+};
+
+
 static struct DAC960_privdata DAC960_BA_privdata = {
         .HardwareType =         DAC960_BA_Controller,
         .FirmwareType   =       DAC960_V2_Controller,
@@ -7007,6 +7132,13 @@ static struct DAC960_privdata DAC960_P_privdata = {
 static struct pci_device_id DAC960_id_table[] = {
         {
                 .vendor         = PCI_VENDOR_ID_MYLEX,
+                .device         = PCI_DEVICE_ID_MYLEX_DAC960_GEM,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .driver_data    = (unsigned long) &DAC960_GEM_privdata,
+        },
+        {
+                .vendor         = PCI_VENDOR_ID_MYLEX,
                 .device         = PCI_DEVICE_ID_MYLEX_DAC960_BA,
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
diff --git a/drivers/block/DAC960.h b/drivers/block/DAC960.h
index d5e8e7190c90..a82f37f749a5 100644
--- a/drivers/block/DAC960.h
+++ b/drivers/block/DAC960.h
@@ -2114,7 +2114,8 @@ typedef enum
   DAC960_LA_Controller =                        3,      /* DAC1164P */
   DAC960_PG_Controller =                        4,      /* DAC960PTL/PJ/PG */
   DAC960_PD_Controller =                        5,      /* DAC960PU/PD/PL/P */
-  DAC960_P_Controller =                         6       /* DAC960PU/PD/PL/P */
+  DAC960_P_Controller =                         6,      /* DAC960PU/PD/PL/P */
+  DAC960_GEM_Controller =                       7,      /* AcceleRAID 4/5/600 */
 }
 DAC960_HardwareType_T;
 
@@ -2541,6 +2542,320 @@ void dma_addr_writeql(dma_addr_t addr, void __iomem *write_address)
 }
 
 /*
+  Define the DAC960 GEM Series Controller Interface Register Offsets.
+ */
+
+#define DAC960_GEM_RegisterWindowSize   0x600
+
+typedef enum
+{
+  DAC960_GEM_InboundDoorBellRegisterReadSetOffset   =   0x214,
+  DAC960_GEM_InboundDoorBellRegisterClearOffset     =   0x218,
+  DAC960_GEM_OutboundDoorBellRegisterReadSetOffset  =   0x224,
+  DAC960_GEM_OutboundDoorBellRegisterClearOffset    =   0x228,
+  DAC960_GEM_InterruptStatusRegisterOffset          =   0x208,
+  DAC960_GEM_InterruptMaskRegisterReadSetOffset     =   0x22C,
+  DAC960_GEM_InterruptMaskRegisterClearOffset       =   0x230,
+  DAC960_GEM_CommandMailboxBusAddressOffset         =   0x510,
+  DAC960_GEM_CommandStatusOffset                    =   0x518,
+  DAC960_GEM_ErrorStatusRegisterReadSetOffset       =   0x224,
+  DAC960_GEM_ErrorStatusRegisterClearOffset         =   0x228,
+}
+DAC960_GEM_RegisterOffsets_T;
+
+/*
+  Define the structure of the DAC960 GEM Series Inbound Door Bell
+ */
+
+typedef union DAC960_GEM_InboundDoorBellRegister
+{
+  unsigned int All;
+  struct {
+    unsigned int :24;
+    boolean HardwareMailboxNewCommand:1;
+    boolean AcknowledgeHardwareMailboxStatus:1;
+    boolean GenerateInterrupt:1;
+    boolean ControllerReset:1;
+    boolean MemoryMailboxNewCommand:1;
+    unsigned int :3;
+  } Write;
+  struct {
+    unsigned int :24;
+    boolean HardwareMailboxFull:1;
+    boolean InitializationInProgress:1;
+    unsigned int :6;
+  } Read;
+}
+DAC960_GEM_InboundDoorBellRegister_T;
+
+/*
+  Define the structure of the DAC960 GEM Series Outbound Door Bell Register.
+ */
+typedef union DAC960_GEM_OutboundDoorBellRegister
+{
+  unsigned int All;
+  struct {
+    unsigned int :24;
+    boolean AcknowledgeHardwareMailboxInterrupt:1;
+    boolean AcknowledgeMemoryMailboxInterrupt:1;
+    unsigned int :6;
+  } Write;
+  struct {
+    unsigned int :24;
+    boolean HardwareMailboxStatusAvailable:1;
+    boolean MemoryMailboxStatusAvailable:1;
+    unsigned int :6;
+  } Read;
+}
+DAC960_GEM_OutboundDoorBellRegister_T;
+
+/*
+  Define the structure of the DAC960 GEM Series Interrupt Mask Register.
+ */
+typedef union DAC960_GEM_InterruptMaskRegister
+{
+  unsigned int All;
+  struct {
+    unsigned int :16;
+    unsigned int :8;
+    unsigned int HardwareMailboxInterrupt:1;
+    unsigned int MemoryMailboxInterrupt:1;
+    unsigned int :6;
+  } Bits;
+}
+DAC960_GEM_InterruptMaskRegister_T;
+
+/*
+  Define the structure of the DAC960 GEM Series Error Status Register.
+ */
+
+typedef union DAC960_GEM_ErrorStatusRegister
+{
+  unsigned int All;
+  struct {
+    unsigned int :24;
+    unsigned int :5;
+    boolean ErrorStatusPending:1;
+    unsigned int :2;
+  } Bits;
+}
+DAC960_GEM_ErrorStatusRegister_T;
+
+/*
+  Define inline functions to provide an abstraction for reading and writing the
+  DAC960 GEM Series Controller Interface Registers.
+*/
+
+static inline
+void DAC960_GEM_HardwareMailboxNewCommand(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All = 0;
+  InboundDoorBellRegister.Write.HardwareMailboxNewCommand = true;
+  writel(InboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InboundDoorBellRegisterReadSetOffset);
+}
+
+static inline
+void DAC960_GEM_AcknowledgeHardwareMailboxStatus(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All = 0;
+  InboundDoorBellRegister.Write.AcknowledgeHardwareMailboxStatus = true;
+  writel(InboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InboundDoorBellRegisterClearOffset);
+}
+
+static inline
+void DAC960_GEM_GenerateInterrupt(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All = 0;
+  InboundDoorBellRegister.Write.GenerateInterrupt = true;
+  writel(InboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InboundDoorBellRegisterReadSetOffset);
+}
+
+static inline
+void DAC960_GEM_ControllerReset(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All = 0;
+  InboundDoorBellRegister.Write.ControllerReset = true;
+  writel(InboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InboundDoorBellRegisterReadSetOffset);
+}
+
+static inline
+void DAC960_GEM_MemoryMailboxNewCommand(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All = 0;
+  InboundDoorBellRegister.Write.MemoryMailboxNewCommand = true;
+  writel(InboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InboundDoorBellRegisterReadSetOffset);
+}
+
+static inline
+boolean DAC960_GEM_HardwareMailboxFullP(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All =
+    readl(ControllerBaseAddress +
+          DAC960_GEM_InboundDoorBellRegisterReadSetOffset);
+  return InboundDoorBellRegister.Read.HardwareMailboxFull;
+}
+
+static inline
+boolean DAC960_GEM_InitializationInProgressP(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InboundDoorBellRegister_T InboundDoorBellRegister;
+  InboundDoorBellRegister.All =
+    readl(ControllerBaseAddress +
+          DAC960_GEM_InboundDoorBellRegisterReadSetOffset);
+  return InboundDoorBellRegister.Read.InitializationInProgress;
+}
+
+static inline
+void DAC960_GEM_AcknowledgeHardwareMailboxInterrupt(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_OutboundDoorBellRegister_T OutboundDoorBellRegister;
+  OutboundDoorBellRegister.All = 0;
+  OutboundDoorBellRegister.Write.AcknowledgeHardwareMailboxInterrupt = true;
+  writel(OutboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_OutboundDoorBellRegisterClearOffset);
+}
+
+static inline
+void DAC960_GEM_AcknowledgeMemoryMailboxInterrupt(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_OutboundDoorBellRegister_T OutboundDoorBellRegister;
+  OutboundDoorBellRegister.All = 0;
+  OutboundDoorBellRegister.Write.AcknowledgeMemoryMailboxInterrupt = true;
+  writel(OutboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_OutboundDoorBellRegisterClearOffset);
+}
+
+static inline
+void DAC960_GEM_AcknowledgeInterrupt(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_OutboundDoorBellRegister_T OutboundDoorBellRegister;
+  OutboundDoorBellRegister.All = 0;
+  OutboundDoorBellRegister.Write.AcknowledgeHardwareMailboxInterrupt = true;
+  OutboundDoorBellRegister.Write.AcknowledgeMemoryMailboxInterrupt = true;
+  writel(OutboundDoorBellRegister.All,
+         ControllerBaseAddress + DAC960_GEM_OutboundDoorBellRegisterClearOffset);
+}
+
+static inline
+boolean DAC960_GEM_HardwareMailboxStatusAvailableP(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_OutboundDoorBellRegister_T OutboundDoorBellRegister;
+  OutboundDoorBellRegister.All =
+    readl(ControllerBaseAddress +
+          DAC960_GEM_OutboundDoorBellRegisterReadSetOffset);
+  return OutboundDoorBellRegister.Read.HardwareMailboxStatusAvailable;
+}
+
+static inline
+boolean DAC960_GEM_MemoryMailboxStatusAvailableP(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_OutboundDoorBellRegister_T OutboundDoorBellRegister;
+  OutboundDoorBellRegister.All =
+    readl(ControllerBaseAddress +
+          DAC960_GEM_OutboundDoorBellRegisterReadSetOffset);
+  return OutboundDoorBellRegister.Read.MemoryMailboxStatusAvailable;
+}
+
+static inline
+void DAC960_GEM_EnableInterrupts(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InterruptMaskRegister_T InterruptMaskRegister;
+  InterruptMaskRegister.All = 0;
+  InterruptMaskRegister.Bits.HardwareMailboxInterrupt = true;
+  InterruptMaskRegister.Bits.MemoryMailboxInterrupt = true;
+  writel(InterruptMaskRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InterruptMaskRegisterClearOffset);
+}
+
+static inline
+void DAC960_GEM_DisableInterrupts(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InterruptMaskRegister_T InterruptMaskRegister;
+  InterruptMaskRegister.All = 0;
+  InterruptMaskRegister.Bits.HardwareMailboxInterrupt = true;
+  InterruptMaskRegister.Bits.MemoryMailboxInterrupt = true;
+  writel(InterruptMaskRegister.All,
+         ControllerBaseAddress + DAC960_GEM_InterruptMaskRegisterReadSetOffset);
+}
+
+static inline
+boolean DAC960_GEM_InterruptsEnabledP(void __iomem *ControllerBaseAddress)
+{
+  DAC960_GEM_InterruptMaskRegister_T InterruptMaskRegister;
+  InterruptMaskRegister.All =
+    readl(ControllerBaseAddress +
+          DAC960_GEM_InterruptMaskRegisterReadSetOffset);
+  return !(InterruptMaskRegister.Bits.HardwareMailboxInterrupt ||
+           InterruptMaskRegister.Bits.MemoryMailboxInterrupt);
+}
+
+static inline
+void DAC960_GEM_WriteCommandMailbox(DAC960_V2_CommandMailbox_T
+                                     *MemoryCommandMailbox,
+                                   DAC960_V2_CommandMailbox_T
+                                     *CommandMailbox)
+{
+  memcpy(&MemoryCommandMailbox->Words[1], &CommandMailbox->Words[1],
+         sizeof(DAC960_V2_CommandMailbox_T) - sizeof(unsigned int));
+  wmb();
+  MemoryCommandMailbox->Words[0] = CommandMailbox->Words[0];
+  mb();
+}
+
+static inline
+void DAC960_GEM_WriteHardwareMailbox(void __iomem *ControllerBaseAddress,
+                                    dma_addr_t CommandMailboxDMA)
+{
+        dma_addr_writeql(CommandMailboxDMA,
+                ControllerBaseAddress +
+                DAC960_GEM_CommandMailboxBusAddressOffset);
+}
+
+static inline DAC960_V2_CommandIdentifier_T
+DAC960_GEM_ReadCommandIdentifier(void __iomem *ControllerBaseAddress)
+{
+  return readw(ControllerBaseAddress + DAC960_GEM_CommandStatusOffset);
+}
+
+static inline DAC960_V2_CommandStatus_T
+DAC960_GEM_ReadCommandStatus(void __iomem *ControllerBaseAddress)
+{
+  return readw(ControllerBaseAddress + DAC960_GEM_CommandStatusOffset + 2);
+}
+
+static inline boolean
+DAC960_GEM_ReadErrorStatus(void __iomem *ControllerBaseAddress,
+                          unsigned char *ErrorStatus,
+                          unsigned char *Parameter0,
+                          unsigned char *Parameter1)
+{
+  DAC960_GEM_ErrorStatusRegister_T ErrorStatusRegister;
+  ErrorStatusRegister.All =
+    readl(ControllerBaseAddress + DAC960_GEM_ErrorStatusRegisterReadSetOffset);
+  if (!ErrorStatusRegister.Bits.ErrorStatusPending) return false;
+  ErrorStatusRegister.Bits.ErrorStatusPending = false;
+  *ErrorStatus = ErrorStatusRegister.All;
+  *Parameter0 =
+    readb(ControllerBaseAddress + DAC960_GEM_CommandMailboxBusAddressOffset + 0);
+  *Parameter1 =
+    readb(ControllerBaseAddress + DAC960_GEM_CommandMailboxBusAddressOffset + 1);
+  writel(0x03000000, ControllerBaseAddress +
+         DAC960_GEM_ErrorStatusRegisterClearOffset);
+  return true;
+}
+
+/*
   Define the DAC960 BA Series Controller Interface Register Offsets.
 */
 
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 42dfa281a880..f0c1084b840f 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3345,7 +3345,7 @@ static inline int set_geometry(unsigned int cmd, struct floppy_struct *g,
                         struct block_device *bdev = opened_bdev[cnt];
                         if (!bdev || ITYPE(drive_state[cnt].fd_device) != type)
                                 continue;
-                        __invalidate_device(bdev, 0);
+                        __invalidate_device(bdev);
                 }
                 up(&open_lock);
         } else {
diff --git a/drivers/block/genhd.c b/drivers/block/genhd.c
index ab4db71375e0..8bbe01d4b487 100644
--- a/drivers/block/genhd.c
+++ b/drivers/block/genhd.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/kmod.h>
 #include <linux/kobj_map.h>
+#include <linux/buffer_head.h>
 
 #define MAX_PROBE_HASH 255      /* random */
 
@@ -676,7 +677,8 @@ int invalidate_partition(struct gendisk *disk, int index)
         int res = 0;
         struct block_device *bdev = bdget_disk(disk, index);
         if (bdev) {
-                res = __invalidate_device(bdev, 1);
+                fsync_bdev(bdev);
+                res = __invalidate_device(bdev);
                 bdput(bdev);
         }
         return res;
diff --git a/drivers/block/ioctl.c b/drivers/block/ioctl.c
index 5e03f5157ef9..6d7bcc9da9e7 100644
--- a/drivers/block/ioctl.c
+++ b/drivers/block/ioctl.c
@@ -237,3 +237,5 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
         }
         return ret;
 }
+
+EXPORT_SYMBOL_GPL(blkdev_ioctl);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 1a1fa3ccb913..bc56770bcc90 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -914,8 +914,10 @@ static int pkt_handle_queue(struct pktcdvd_device *pd)
                 bio = node->bio;
                 zone = ZONE(bio->bi_sector, pd);
                 list_for_each_entry(p, &pd->cdrw.pkt_active_list, list) {
-                        if (p->sector == zone)
+                        if (p->sector == zone) {
+                                bio = NULL;
                                 goto try_next_bio;
+                        }
                 }
                 break;
 try_next_bio:
@@ -2019,7 +2021,13 @@ static int pkt_open(struct inode *inode, struct file *file)
         BUG_ON(pd->refcnt < 0);
 
         pd->refcnt++;
-        if (pd->refcnt == 1) {
+        if (pd->refcnt > 1) {
+                if ((file->f_mode & FMODE_WRITE) &&
+                    !test_bit(PACKET_WRITABLE, &pd->flags)) {
+                        ret = -EBUSY;
+                        goto out_dec;
+                }
+        } else {
                 if (pkt_open_dev(pd, file->f_mode & FMODE_WRITE)) {
                         ret = -EIO;
                         goto out_dec;
@@ -2406,7 +2414,7 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
         case CDROM_LAST_WRITTEN:
         case CDROM_SEND_PACKET:
         case SCSI_IOCTL_SEND_COMMAND:
-                return ioctl_by_bdev(pd->bdev, cmd, arg);
+                return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
         case CDROMEJECT:
                 /*
@@ -2414,7 +2422,7 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
                  * have to unlock it or else the eject command fails.
                  */
                 pkt_lock_door(pd, 0);
-                return ioctl_by_bdev(pd->bdev, cmd, arg);
+                return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
         default:
                 printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
diff --git a/drivers/cdrom/cdu31a.c b/drivers/cdrom/cdu31a.c
index 647a71b12a2a..ac96de15d833 100644
--- a/drivers/cdrom/cdu31a.c
+++ b/drivers/cdrom/cdu31a.c
@@ -292,7 +292,7 @@ module_param(cdu31a_irq, int, 0);
 
 /* The interrupt handler will wake this queue up when it gets an
    interrupts. */
-DECLARE_WAIT_QUEUE_HEAD(cdu31a_irq_wait);
+static DECLARE_WAIT_QUEUE_HEAD(cdu31a_irq_wait);
 static int irq_flag = 0;
 
 static int curr_control_reg = 0;        /* Current value of the control register */
@@ -2947,7 +2947,7 @@ static int scd_block_media_changed(struct gendisk *disk)
         return cdrom_media_changed(&scd_info);
 }
 
-struct block_device_operations scd_bdops =
+static struct block_device_operations scd_bdops =
 {
         .owner          = THIS_MODULE,
         .open           = scd_block_open,
@@ -3216,7 +3216,7 @@ errout3:
 }
 
 
-void __exit cdu31a_exit(void)
+static void __exit cdu31a_exit(void)
 {
         del_gendisk(scd_gendisk);
         put_disk(scd_gendisk);
diff --git a/drivers/cdrom/mcdx.c b/drivers/cdrom/mcdx.c
index ccde7ab491d4..07bbd24e3c18 100644
--- a/drivers/cdrom/mcdx.c
+++ b/drivers/cdrom/mcdx.c
@@ -107,20 +107,20 @@ static const char *mcdx_c_version
    The _direct_ size is the number of sectors we're allowed to skip
    directly (performing a read instead of requesting the new sector
    needed */
-const int REQUEST_SIZE = 800;   /* should be less then 255 * 4 */
-const int DIRECT_SIZE = 400;    /* should be less then REQUEST_SIZE */
+static const int REQUEST_SIZE = 800;    /* should be less then 255 * 4 */
+static const int DIRECT_SIZE = 400;     /* should be less then REQUEST_SIZE */
 
 enum drivemodes { TOC, DATA, RAW, COOKED };
 enum datamodes { MODE0, MODE1, MODE2 };
 enum resetmodes { SOFT, HARD };
 
-const int SINGLE = 0x01;        /* single speed drive (FX001S, LU) */
-const int DOUBLE = 0x02;        /* double speed drive (FX001D, ..? */
-const int DOOR = 0x04;          /* door locking capability */
-const int MULTI = 0x08;         /* multi session capability */
+static const int SINGLE = 0x01;         /* single speed drive (FX001S, LU) */
+static const int DOUBLE = 0x02;         /* double speed drive (FX001D, ..? */
+static const int DOOR = 0x04;           /* door locking capability */
+static const int MULTI = 0x08;          /* multi session capability */
 
-const unsigned char READ1X = 0xc0;
-const unsigned char READ2X = 0xc1;
+static const unsigned char READ1X = 0xc0;
+static const unsigned char READ2X = 0xc1;
 
 
 /* DECLARATIONS ****************************************************/
@@ -210,9 +210,7 @@ struct s_drive_stuff {
         repeated here to show what's going on.  And to sense, if they're
         changed elsewhere. */
 
-/* declared in blk.h */
-int mcdx_init(void);
-void do_mcdx_request(request_queue_t * q);
+static int mcdx_init(void);
 
 static int mcdx_block_open(struct inode *inode, struct file *file)
 {
@@ -569,7 +567,7 @@ static int mcdx_audio_ioctl(struct cdrom_device_info *cdi,
         }
 }
 
-void do_mcdx_request(request_queue_t * q)
+static void do_mcdx_request(request_queue_t * q)
 {
         struct s_drive_stuff *stuffp;
         struct request *req;
@@ -1028,7 +1026,7 @@ int __mcdx_init(void)
         return 0;
 }
 
-void __exit mcdx_exit(void)
+static void __exit mcdx_exit(void)
 {
         int i;
 
@@ -1075,7 +1073,7 @@ module_exit(mcdx_exit);
 
 /* Support functions ************************************************/
 
-int __init mcdx_init_drive(int drive)
+static int __init mcdx_init_drive(int drive)
 {
         struct s_version version;
         struct gendisk *disk;
@@ -1261,7 +1259,7 @@ int __init mcdx_init_drive(int drive)
         return 0;
 }
 
-int __init mcdx_init(void)
+static int __init mcdx_init(void)
 {
         int drive;
         xwarn("Version 2.14(hs) \n");
diff --git a/drivers/cdrom/sbpcd.c b/drivers/cdrom/sbpcd.c
index fc2c433f6a29..452d34675159 100644
--- a/drivers/cdrom/sbpcd.c
+++ b/drivers/cdrom/sbpcd.c
@@ -5895,7 +5895,7 @@ int __init sbpcd_init(void)
 }
 /*==========================================================================*/
 #ifdef MODULE
-void sbpcd_exit(void)
+static void sbpcd_exit(void)
 {
         int j;
         
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 49d67f5384a2..4bb9af736fba 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -44,6 +44,7 @@
 #include <linux/ipmi.h>
 #include <asm/semaphore.h>
 #include <linux/init.h>
+#include <linux/device.h>
 
 #define IPMI_DEVINTF_VERSION "v33"
 
@@ -519,15 +520,21 @@ MODULE_PARM_DESC(ipmi_major, "Sets the major number of the IPMI device.  By"
                  " interface.  Other values will set the major device number"
                  " to that value.");
 
+static struct class *ipmi_class;
+
 static void ipmi_new_smi(int if_num)
 {
-        devfs_mk_cdev(MKDEV(ipmi_major, if_num),
-                      S_IFCHR | S_IRUSR | S_IWUSR,
+        dev_t dev = MKDEV(ipmi_major, if_num);
+
+        devfs_mk_cdev(dev, S_IFCHR | S_IRUSR | S_IWUSR,
                       "ipmidev/%d", if_num);
+
+        class_simple_device_add(ipmi_class, dev, NULL, "ipmi%d", if_num);
 }
 
 static void ipmi_smi_gone(int if_num)
 {
+        class_simple_device_remove(ipmi_class, MKDEV(ipmi_major, if_num));
         devfs_remove("ipmidev/%d", if_num);
 }
 
@@ -548,8 +555,15 @@ static __init int init_ipmi_devintf(void)
         printk(KERN_INFO "ipmi device interface version "
                IPMI_DEVINTF_VERSION "\n");
 
+        ipmi_class = class_simple_create(THIS_MODULE, "ipmi");
+        if (IS_ERR(ipmi_class)) {
+                printk(KERN_ERR "ipmi: can't register device class\n");
+                return PTR_ERR(ipmi_class);
+        }
+
         rv = register_chrdev(ipmi_major, DEVICE_NAME, &ipmi_fops);
         if (rv < 0) {
+                class_simple_destroy(ipmi_class);
                 printk(KERN_ERR "ipmi: can't get major %d\n", ipmi_major);
                 return rv;
         }
@@ -563,6 +577,7 @@ static __init int init_ipmi_devintf(void)
         rv = ipmi_smi_watcher_register(&smi_watcher);
         if (rv) {
                 unregister_chrdev(ipmi_major, DEVICE_NAME);
+                class_simple_destroy(ipmi_class);
                 printk(KERN_WARNING "ipmi: can't register smi watcher\n");
                 return rv;
         }
@@ -573,6 +588,7 @@ module_init(init_ipmi_devintf);
 
 static __exit void cleanup_ipmi(void)
 {
+        class_simple_destroy(ipmi_class);
         ipmi_smi_watcher_unregister(&smi_watcher);
         devfs_remove(DEVICE_NAME);
         unregister_chrdev(ipmi_major, DEVICE_NAME);
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 3ce51c6a1b18..7b19e02f112f 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -1026,7 +1026,8 @@ static void kbd_rawcode(unsigned char data)
                 put_queue(vc, data);
 }
 
-void kbd_keycode(unsigned int keycode, int down, int hw_raw, struct pt_regs *regs)
+static void kbd_keycode(unsigned int keycode, int down,
+                        int hw_raw, struct pt_regs *regs)
 {
         struct vc_data *vc = vc_cons[fg_console].d;
         unsigned short keysym, *key_map;
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index a2e33ec79615..ca5f42bcaad9 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -122,7 +122,7 @@ raw_ioctl(struct inode *inode, struct file *filp,
 {
         struct block_device *bdev = filp->private_data;
 
-        return ioctl_by_bdev(bdev, command, arg);
+        return blkdev_ioctl(bdev->bd_inode, NULL, command, arg);
 }
 
 static void bind_device(struct raw_config_request *rq)
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 06e5a3f1836d..26e5e19ed854 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -185,7 +185,7 @@ char *tty_name(struct tty_struct *tty, char *buf)
 
 EXPORT_SYMBOL(tty_name);
 
-inline int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
+int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
                               const char *routine)
 {
 #ifdef TTY_PARANOIA_CHECK
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index c337978dc966..b14d642439ed 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -382,6 +382,7 @@ static struct pci_device_id i8xx_tco_pci_tbl[] = {
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_2,      PCI_ANY_ID, PCI_ANY_ID, },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_0,      PCI_ANY_ID, PCI_ANY_ID, },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_1,      PCI_ANY_ID, PCI_ANY_ID, },
+        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_1,       PCI_ANY_ID, PCI_ANY_ID, },
         { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE (pci, i8xx_tco_pci_tbl);
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index bdff5ac58053..4b1e43b4118b 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -516,6 +516,6 @@ void proc_ide_create(void)
 
 void proc_ide_destroy(void)
 {
-        remove_proc_entry("ide/drivers", proc_ide_root);
+        remove_proc_entry("drivers", proc_ide_root);
         remove_proc_entry("ide", NULL);
 }
diff --git a/drivers/ide/pci/sis5513.c b/drivers/ide/pci/sis5513.c
index 9d70ba5ea59b..16b3e2d8bfb1 100644
--- a/drivers/ide/pci/sis5513.c
+++ b/drivers/ide/pci/sis5513.c
@@ -726,7 +726,7 @@ static int sis5513_config_xfer_rate (ide_drive_t *drive)
 */
 
 /* Chip detection and general config */
-static unsigned int __init init_chipset_sis5513 (struct pci_dev *dev, const char *name)
+static unsigned int __devinit init_chipset_sis5513 (struct pci_dev *dev, const char *name)
 {
         struct pci_dev *host;
         int i = 0;
@@ -879,7 +879,7 @@ static unsigned int __init init_chipset_sis5513 (struct pci_dev *dev, const char
         return 0;
 }
 
-static unsigned int __init ata66_sis5513 (ide_hwif_t *hwif)
+static unsigned int __devinit ata66_sis5513 (ide_hwif_t *hwif)
 {
         u8 ata66 = 0;
 
@@ -897,7 +897,7 @@ static unsigned int __init ata66_sis5513 (ide_hwif_t *hwif)
         return ata66;
 }
 
-static void __init init_hwif_sis5513 (ide_hwif_t *hwif)
+static void __devinit init_hwif_sis5513 (ide_hwif_t *hwif)
 {
         hwif->autodma = 0;
 
diff --git a/drivers/ieee1394/Kconfig b/drivers/ieee1394/Kconfig
index 78b201fb5e8a..7d58af1ae306 100644
--- a/drivers/ieee1394/Kconfig
+++ b/drivers/ieee1394/Kconfig
@@ -84,11 +84,6 @@ config IEEE1394_PCILYNX
           To compile this driver as a module, say M here: the
           module will be called pcilynx.
 
-# Non-maintained pcilynx options
-# if [ "$CONFIG_IEEE1394_PCILYNX" != "n" ]; then
-#     bool '    Use PCILynx local RAM' CONFIG_IEEE1394_PCILYNX_LOCALRAM
-#     bool '    Support for non-IEEE1394 local ports' CONFIG_IEEE1394_PCILYNX_PORTS
-# fi
 config IEEE1394_OHCI1394
         tristate "OHCI-1394 support"
         depends on PCI && IEEE1394
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index 1c5845f7e4ab..a294e45c77cd 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -520,7 +520,7 @@ int hpsb_send_packet(struct hpsb_packet *packet)
 
         if (!packet->no_waiter || packet->expect_response) {
                 atomic_inc(&packet->refcnt);
-                packet->sendtime = jiffies;
+                packet->sendtime = jiffies + 10 * HZ;
                 skb_queue_tail(&host->pending_packet_queue, packet->skb);
         }
 
@@ -1248,7 +1248,6 @@ EXPORT_SYMBOL(hpsb_make_phypacket);
 EXPORT_SYMBOL(hpsb_make_isopacket);
 EXPORT_SYMBOL(hpsb_read);
 EXPORT_SYMBOL(hpsb_write);
-EXPORT_SYMBOL(hpsb_lock);
 EXPORT_SYMBOL(hpsb_packet_success);
 
 /** highlevel.c **/
diff --git a/drivers/ieee1394/ieee1394_transactions.c b/drivers/ieee1394/ieee1394_transactions.c
index 09908b9564d8..0aa876360f9b 100644
--- a/drivers/ieee1394/ieee1394_transactions.c
+++ b/drivers/ieee1394/ieee1394_transactions.c
@@ -535,6 +535,7 @@ hpsb_write_fail:
         return retval;
 }
 
+#if 0
 
 int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
               u64 addr, int extcode, quadlet_t *data, quadlet_t arg)
@@ -599,3 +600,5 @@ int hpsb_send_gasp(struct hpsb_host *host, int channel, unsigned int generation,
 
         return retval;
 }
+
+#endif  /*  0  */
diff --git a/drivers/ieee1394/ieee1394_transactions.h b/drivers/ieee1394/ieee1394_transactions.h
index 526a43ceb496..45ba784fe6da 100644
--- a/drivers/ieee1394/ieee1394_transactions.h
+++ b/drivers/ieee1394/ieee1394_transactions.h
@@ -53,12 +53,5 @@ int hpsb_read(struct hpsb_host *host, nodeid_t node, unsigned int generation,
               u64 addr, quadlet_t *buffer, size_t length);
 int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
                u64 addr, quadlet_t *buffer, size_t length);
-int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
-              u64 addr, int extcode, quadlet_t *data, quadlet_t arg);
-int hpsb_lock64(struct hpsb_host *host, nodeid_t node, unsigned int generation,
-                u64 addr, int extcode, octlet_t *data, octlet_t arg);
-int hpsb_send_gasp(struct hpsb_host *host, int channel, unsigned int generation,
-                   quadlet_t *buffer, size_t length, u32 specifier_id,
-                   unsigned int version);
 
 #endif /* _IEEE1394_TRANSACTIONS_H */
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index a1e30a66297b..83e66ed97ab5 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -1005,8 +1005,7 @@ static struct unit_directory *nodemgr_process_unit_directory
         return ud;
 
 unit_directory_error:
-        if (ud != NULL)
-                kfree(ud);
+        kfree(ud);
         return NULL;
 }
 
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index 6cb0b586c297..36e25ac823dc 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -2931,7 +2931,7 @@ static void free_dma_rcv_ctx(struct dma_rcv_ctx *d)
                 kfree(d->prg_cpu);
                 kfree(d->prg_bus);
         }
-        if (d->spb) kfree(d->spb);
+        kfree(d->spb);
 
         /* Mark this context as freed. */
         d->ohci = NULL;
diff --git a/drivers/ieee1394/ohci1394.h b/drivers/ieee1394/ohci1394.h
index d1758d409610..cc66c1cae250 100644
--- a/drivers/ieee1394/ohci1394.h
+++ b/drivers/ieee1394/ohci1394.h
@@ -236,6 +236,9 @@ struct ti_ohci {
 
 static inline int cross_bound(unsigned long addr, unsigned int size)
 {
+        if (size == 0)
+                return 0;
+
         if (size > PAGE_SIZE)
                 return 1;
 
diff --git a/drivers/ieee1394/pcilynx.c b/drivers/ieee1394/pcilynx.c
index a261d2b0e5ac..bdb3a85cafa6 100644
--- a/drivers/ieee1394/pcilynx.c
+++ b/drivers/ieee1394/pcilynx.c
@@ -43,6 +43,7 @@
 #include <linux/fs.h>
 #include <linux/poll.h>
 #include <linux/kdev_t.h>
+#include <linux/dma-mapping.h>
 #include <asm/byteorder.h>
 #include <asm/atomic.h>
 #include <asm/io.h>
@@ -834,327 +835,6 @@ static int lynx_devctl(struct hpsb_host *host, enum devctl_cmd cmd, int arg)
  * IEEE-1394 functionality section END *
  ***************************************/
 
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-/* VFS functions for local bus / aux device access.  Access to those
- * is implemented as a character device instead of block devices
- * because buffers are not wanted for this.  Therefore llseek (from
- * VFS) can be used for these char devices with obvious effects.
- */
-static int mem_open(struct inode*, struct file*);
-static int mem_release(struct inode*, struct file*);
-static unsigned int aux_poll(struct file*, struct poll_table_struct*);
-static loff_t mem_llseek(struct file*, loff_t, int);
-static ssize_t mem_read (struct file*, char*, size_t, loff_t*);
-static ssize_t mem_write(struct file*, const char*, size_t, loff_t*);
-
-
-static struct file_operations aux_ops = {
-        .owner =        THIS_MODULE,
-        .read =         mem_read,
-        .write =        mem_write,
-        .poll =         aux_poll,
-        .llseek =       mem_llseek,
-        .open =         mem_open,
-        .release =      mem_release,
-};
-
-
-static void aux_setup_pcls(struct ti_lynx *lynx)
-{
-        struct ti_pcl pcl;
-
-        pcl.next = PCL_NEXT_INVALID;
-        pcl.user_data = pcl_bus(lynx, lynx->dmem_pcl);
-        put_pcl(lynx, lynx->dmem_pcl, &pcl);
-}
-
-static int mem_open(struct inode *inode, struct file *file)
-{
-        int cid = iminor(inode);
-        enum { t_rom, t_aux, t_ram } type;
-        struct memdata *md;
-
-        if (cid < PCILYNX_MINOR_AUX_START) {
-                /* just for completeness */
-                return -ENXIO;
-        } else if (cid < PCILYNX_MINOR_ROM_START) {
-                cid -= PCILYNX_MINOR_AUX_START;
-                if (cid >= num_of_cards || !cards[cid].aux_port)
-                        return -ENXIO;
-                type = t_aux;
-        } else if (cid < PCILYNX_MINOR_RAM_START) {
-                cid -= PCILYNX_MINOR_ROM_START;
-                if (cid >= num_of_cards || !cards[cid].local_rom)
-                        return -ENXIO;
-                type = t_rom;
-        } else {
-                /* WARNING: Know what you are doing when opening RAM.
-                 * It is currently used inside the driver! */
-                cid -= PCILYNX_MINOR_RAM_START;
-                if (cid >= num_of_cards || !cards[cid].local_ram)
-                        return -ENXIO;
-                type = t_ram;
-        }
-
-        md = (struct memdata *)kmalloc(sizeof(struct memdata), SLAB_KERNEL);
-        if (md == NULL)
-                return -ENOMEM;
-
-        md->lynx = &cards[cid];
-        md->cid = cid;
-
-        switch (type) {
-        case t_rom:
-                md->type = rom;
-                break;
-        case t_ram:
-                md->type = ram;
-                break;
-        case t_aux:
-                atomic_set(&md->aux_intr_last_seen,
-                           atomic_read(&cards[cid].aux_intr_seen));
-                md->type = aux;
-                break;
-        }
-
-        file->private_data = md;
-
-        return 0;
-}
-
-static int mem_release(struct inode *inode, struct file *file)
-{
-        kfree(file->private_data);
-        return 0;
-}
-
-static unsigned int aux_poll(struct file *file, poll_table *pt)
-{
-        struct memdata *md = (struct memdata *)file->private_data;
-        int cid = md->cid;
-        unsigned int mask;
-
-        /* reading and writing is always allowed */
-        mask = POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM;
-
-        if (md->type == aux) {
-                poll_wait(file, &cards[cid].aux_intr_wait, pt);
-
-                if (atomic_read(&md->aux_intr_last_seen)
-                    != atomic_read(&cards[cid].aux_intr_seen)) {
-                        mask |= POLLPRI;
-                        atomic_inc(&md->aux_intr_last_seen);
-                }
-        }
-
-        return mask;
-}
-
-loff_t mem_llseek(struct file *file, loff_t offs, int orig)
-{
-        loff_t newoffs;
-
-        switch (orig) {
-        case 0:
-                newoffs = offs;
-                break;
-        case 1:
-                newoffs = offs + file->f_pos;
-                break;
-        case 2:
-                newoffs = PCILYNX_MAX_MEMORY + 1 + offs;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        if (newoffs < 0 || newoffs > PCILYNX_MAX_MEMORY + 1) return -EINVAL;
-
-        file->f_pos = newoffs;
-        return newoffs;
-}
-
-/*
- * do not DMA if count is too small because this will have a serious impact
- * on performance - the value 2400 was found by experiment and may not work
- * everywhere as good as here - use mem_mindma option for modules to change
- */
-static short mem_mindma = 2400;
-module_param(mem_mindma, short, 0444);
-MODULE_PARM_DESC(mem_mindma, "Minimum amount of data required to use DMA");
-
-static ssize_t mem_dmaread(struct memdata *md, u32 physbuf, ssize_t count,
-                           int offset)
-{
-        pcltmp_t pcltmp;
-        struct ti_pcl *pcl;
-        size_t retval;
-        int i;
-        DECLARE_WAITQUEUE(wait, current);
-
-        count &= ~3;
-        count = min(count, 53196);
-        retval = count;
-
-        if (reg_read(md->lynx, DMA_CHAN_CTRL(CHANNEL_LOCALBUS))
-            & DMA_CHAN_CTRL_BUSY) {
-                PRINT(KERN_WARNING, md->lynx->id, "DMA ALREADY ACTIVE!");
-        }
-
-        reg_write(md->lynx, LBUS_ADDR, md->type | offset);
-
-        pcl = edit_pcl(md->lynx, md->lynx->dmem_pcl, &pcltmp);
-        pcl->buffer[0].control = PCL_CMD_LBUS_TO_PCI | min(count, 4092);
-        pcl->buffer[0].pointer = physbuf;
-        count -= 4092;
-
-        i = 0;
-        while (count > 0) {
-                i++;
-                pcl->buffer[i].control = min(count, 4092);
-                pcl->buffer[i].pointer = physbuf + i * 4092;
-                count -= 4092;
-        }
-        pcl->buffer[i].control |= PCL_LAST_BUFF;
-        commit_pcl(md->lynx, md->lynx->dmem_pcl, &pcltmp);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-        add_wait_queue(&md->lynx->mem_dma_intr_wait, &wait);
-        run_sub_pcl(md->lynx, md->lynx->dmem_pcl, 2, CHANNEL_LOCALBUS);
-
-        schedule();
-        while (reg_read(md->lynx, DMA_CHAN_CTRL(CHANNEL_LOCALBUS))
-               & DMA_CHAN_CTRL_BUSY) {
-                if (signal_pending(current)) {
-                        retval = -EINTR;
-                        break;
-                }
-                schedule();
-        }
-
-        reg_write(md->lynx, DMA_CHAN_CTRL(CHANNEL_LOCALBUS), 0);
-        remove_wait_queue(&md->lynx->mem_dma_intr_wait, &wait);
-
-        if (reg_read(md->lynx, DMA_CHAN_CTRL(CHANNEL_LOCALBUS))
-            & DMA_CHAN_CTRL_BUSY) {
-                PRINT(KERN_ERR, md->lynx->id, "DMA STILL ACTIVE!");
-        }
-
-        return retval;
-}
-
-static ssize_t mem_read(struct file *file, char *buffer, size_t count,
-                        loff_t *offset)
-{
-        struct memdata *md = (struct memdata *)file->private_data;
-        ssize_t bcount;
-        size_t alignfix;
-        loff_t off = *offset; /* avoid useless 64bit-arithmetic */
-        ssize_t retval;
-        void *membase;
-
-        if ((off + count) > PCILYNX_MAX_MEMORY+1) {
-                count = PCILYNX_MAX_MEMORY+1 - off;
-        }
-        if (count == 0 || off > PCILYNX_MAX_MEMORY) {
-                return -ENOSPC;
-        }
-
-        switch (md->type) {
-        case rom:
-                membase = md->lynx->local_rom;
-                break;
-        case ram:
-                membase = md->lynx->local_ram;
-                break;
-        case aux:
-                membase = md->lynx->aux_port;
-                break;
-        default:
-                panic("pcilynx%d: unsupported md->type %d in %s",
-                      md->lynx->id, md->type, __FUNCTION__);
-        }
-
-        down(&md->lynx->mem_dma_mutex);
-
-        if (count < mem_mindma) {
-                memcpy_fromio(md->lynx->mem_dma_buffer, membase+off, count);
-                goto out;
-        }
-
-        bcount = count;
-        alignfix = 4 - (off % 4);
-        if (alignfix != 4) {
-                if (bcount < alignfix) {
-                        alignfix = bcount;
-                }
-                memcpy_fromio(md->lynx->mem_dma_buffer, membase+off,
-                              alignfix);
-                if (bcount == alignfix) {
-                        goto out;
-                }
-                bcount -= alignfix;
-                off += alignfix;
-        }
-
-        while (bcount >= 4) {
-                retval = mem_dmaread(md, md->lynx->mem_dma_buffer_dma
-                                     + count - bcount, bcount, off);
-                if (retval < 0) return retval;
-
-                bcount -= retval;
-                off += retval;
-        }
-
-        if (bcount) {
-                memcpy_fromio(md->lynx->mem_dma_buffer + count - bcount,
-                              membase+off, bcount);
-        }
-
- out:
-        retval = copy_to_user(buffer, md->lynx->mem_dma_buffer, count);
-        up(&md->lynx->mem_dma_mutex);
-
-        if (retval) return -EFAULT;
-        *offset += count;
-        return count;
-}
-
-
-static ssize_t mem_write(struct file *file, const char *buffer, size_t count,
-                         loff_t *offset)
-{
-        struct memdata *md = (struct memdata *)file->private_data;
-
-        if (((*offset) + count) > PCILYNX_MAX_MEMORY+1) {
-                count = PCILYNX_MAX_MEMORY+1 - *offset;
-        }
-        if (count == 0 || *offset > PCILYNX_MAX_MEMORY) {
-                return -ENOSPC;
-        }
-
-        /* FIXME: dereferencing pointers to PCI mem doesn't work everywhere */
-        switch (md->type) {
-        case aux:
-                if (copy_from_user(md->lynx->aux_port+(*offset), buffer, count))
-                        return -EFAULT;
-                break;
-        case ram:
-                if (copy_from_user(md->lynx->local_ram+(*offset), buffer, count))
-                        return -EFAULT;
-                break;
-        case rom:
-                /* the ROM may be writeable */
-                if (copy_from_user(md->lynx->local_rom+(*offset), buffer, count))
-                        return -EFAULT;
-                break;
-        }
-
-        file->f_pos += count;
-        return count;
-}
-#endif /* CONFIG_IEEE1394_PCILYNX_PORTS */
-
 
 /********************************************************
  * Global stuff (interrupt handler, init/shutdown code) *
@@ -1181,18 +861,6 @@ static irqreturn_t lynx_irq_handler(int irq, void *dev_id,
         reg_write(lynx, LINK_INT_STATUS, linkint);
         reg_write(lynx, PCI_INT_STATUS, intmask);
 
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        if (intmask & PCI_INT_AUX_INT) {
-                atomic_inc(&lynx->aux_intr_seen);
-                wake_up_interruptible(&lynx->aux_intr_wait);
-        }
-
-        if (intmask & PCI_INT_DMA_HLT(CHANNEL_LOCALBUS)) {
-                wake_up_interruptible(&lynx->mem_dma_intr_wait);
-        }
-#endif
-
-
         if (intmask & PCI_INT_1394) {
                 if (linkint & LINK_INT_PHY_TIMEOUT) {
                         PRINT(KERN_INFO, lynx->id, "PHY timeout occurred");
@@ -1484,15 +1152,9 @@ static void remove_card(struct pci_dev *dev)
                 pci_free_consistent(lynx->dev, PAGE_SIZE, lynx->rcv_page,
                                     lynx->rcv_page_dma);
         case have_aux_buf:
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-                pci_free_consistent(lynx->dev, 65536, lynx->mem_dma_buffer,
-                                    lynx->mem_dma_buffer_dma);
-#endif
         case have_pcl_mem:
-#ifndef CONFIG_IEEE1394_PCILYNX_LOCALRAM
                 pci_free_consistent(lynx->dev, LOCALRAM_SIZE, lynx->pcl_mem,
                                     lynx->pcl_mem_dma);
-#endif
         case clear:
                 /* do nothing - already freed */
                 ;
@@ -1524,7 +1186,7 @@ static int __devinit add_card(struct pci_dev *dev,
 
         error = -ENXIO;
 
-        if (pci_set_dma_mask(dev, 0xffffffff))
+        if (pci_set_dma_mask(dev, DMA_32BIT_MASK))
                 FAIL("DMA address limits not supported for PCILynx hardware");
         if (pci_enable_device(dev))
                 FAIL("failed to enable PCILynx hardware");
@@ -1546,7 +1208,6 @@ static int __devinit add_card(struct pci_dev *dev,
         spin_lock_init(&lynx->lock);
         spin_lock_init(&lynx->phy_reg_lock);
 
-#ifndef CONFIG_IEEE1394_PCILYNX_LOCALRAM
         lynx->pcl_mem = pci_alloc_consistent(dev, LOCALRAM_SIZE,
                                              &lynx->pcl_mem_dma);
 
@@ -1558,16 +1219,6 @@ static int __devinit add_card(struct pci_dev *dev,
         } else {
                 FAIL("failed to allocate PCL memory area");
         }
-#endif
-
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        lynx->mem_dma_buffer = pci_alloc_consistent(dev, 65536,
-                                                    &lynx->mem_dma_buffer_dma);
-        if (lynx->mem_dma_buffer == NULL) {
-                FAIL("failed to allocate DMA buffer for aux");
-        }
-        lynx->state = have_aux_buf;
-#endif
 
         lynx->rcv_page = pci_alloc_consistent(dev, PAGE_SIZE,
                                               &lynx->rcv_page_dma);
@@ -1597,13 +1248,6 @@ static int __devinit add_card(struct pci_dev *dev,
                 FAIL("failed to remap registers - card not accessible");
         }
 
-#ifdef CONFIG_IEEE1394_PCILYNX_LOCALRAM
-        if (lynx->local_ram == NULL) {
-                FAIL("failed to remap local RAM which is required for "
-                     "operation");
-        }
-#endif
-
         reg_set_bits(lynx, MISC_CONTROL, MISC_CONTROL_SWRESET);
         /* Fix buggy cards with autoboot pin not tied low: */
         reg_write(lynx, DMA0_CHAN_CTRL, 0);
@@ -1624,13 +1268,6 @@ static int __devinit add_card(struct pci_dev *dev,
 
         /* alloc_pcl return values are not checked, it is expected that the
          * provided PCL space is sufficient for the initial allocations */
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        if (lynx->aux_port != NULL) {
-                lynx->dmem_pcl = alloc_pcl(lynx);
-                aux_setup_pcls(lynx);
-                sema_init(&lynx->mem_dma_mutex, 1);
-        }
-#endif
         lynx->rcv_pcl = alloc_pcl(lynx);
         lynx->rcv_pcl_start = alloc_pcl(lynx);
         lynx->async.pcl = alloc_pcl(lynx);
@@ -1647,12 +1284,6 @@ static int __devinit add_card(struct pci_dev *dev,
 
         reg_write(lynx, PCI_INT_ENABLE, PCI_INT_DMA_ALL);
 
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        reg_set_bits(lynx, PCI_INT_ENABLE, PCI_INT_AUX_INT);
-        init_waitqueue_head(&lynx->mem_dma_intr_wait);
-        init_waitqueue_head(&lynx->aux_intr_wait);
-#endif
-
         tasklet_init(&lynx->iso_rcv.tq, (void (*)(unsigned long))iso_rcv_bh,
                      (unsigned long)lynx);
 
@@ -1944,37 +1575,18 @@ static int __init pcilynx_init(void)
 {
         int ret;
 
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        if (register_chrdev(PCILYNX_MAJOR, PCILYNX_DRIVER_NAME, &aux_ops)) {
-                PRINT_G(KERN_ERR, "allocation of char major number %d failed",
-                        PCILYNX_MAJOR);
-                return -EBUSY;
-        }
-#endif
-
         ret = pci_register_driver(&lynx_pci_driver);
         if (ret < 0) {
                 PRINT_G(KERN_ERR, "PCI module init failed");
-                goto free_char_dev;
+                return ret;
         }
 
         return 0;
-
- free_char_dev:
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        unregister_chrdev(PCILYNX_MAJOR, PCILYNX_DRIVER_NAME);
-#endif
-
-        return ret;
 }
 
 static void __exit pcilynx_cleanup(void)
 {
         pci_unregister_driver(&lynx_pci_driver);
-
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        unregister_chrdev(PCILYNX_MAJOR, PCILYNX_DRIVER_NAME);
-#endif
 }
 
 
diff --git a/drivers/ieee1394/pcilynx.h b/drivers/ieee1394/pcilynx.h
index 644ec55d3d46..d631aa8383ad 100644
--- a/drivers/ieee1394/pcilynx.h
+++ b/drivers/ieee1394/pcilynx.h
@@ -55,16 +55,6 @@ struct ti_lynx {
         void __iomem *aux_port;
         quadlet_t bus_info_block[5];
 
-#ifdef CONFIG_IEEE1394_PCILYNX_PORTS
-        atomic_t aux_intr_seen;
-        wait_queue_head_t aux_intr_wait;
-
-        void *mem_dma_buffer;
-        dma_addr_t mem_dma_buffer_dma;
-        struct semaphore mem_dma_mutex;
-        wait_queue_head_t mem_dma_intr_wait;
-#endif
-
         /*
          * use local RAM of LOCALRAM_SIZE bytes for PCLs, which allows for
          * LOCALRAM_SIZE * 8 PCLs (each sized 128 bytes);
@@ -72,11 +62,9 @@ struct ti_lynx {
          */
         u8 pcl_bmap[LOCALRAM_SIZE / 1024];
 
-#ifndef CONFIG_IEEE1394_PCILYNX_LOCALRAM
         /* point to PCLs memory area if needed */
         void *pcl_mem;
         dma_addr_t pcl_mem_dma;
-#endif
 
         /* PCLs for local mem / aux transfers */
         pcl_t dmem_pcl;
@@ -378,39 +366,6 @@ struct ti_pcl {
 #define pcloffs(MEMBER) (offsetof(struct ti_pcl, MEMBER))
 
 
-#ifdef CONFIG_IEEE1394_PCILYNX_LOCALRAM
-
-static inline void put_pcl(const struct ti_lynx *lynx, pcl_t pclid,
-                           const struct ti_pcl *pcl)
-{
-        int i;
-        u32 *in = (u32 *)pcl;
-        u32 *out = (u32 *)(lynx->local_ram + pclid * sizeof(struct ti_pcl));
-
-        for (i = 0; i < 32; i++, out++, in++) {
-                writel(*in, out);
-        }
-}
-
-static inline void get_pcl(const struct ti_lynx *lynx, pcl_t pclid,
-                           struct ti_pcl *pcl)
-{
-        int i;
-        u32 *out = (u32 *)pcl;
-        u32 *in = (u32 *)(lynx->local_ram + pclid * sizeof(struct ti_pcl));
-
-        for (i = 0; i < 32; i++, out++, in++) {
-                *out = readl(in);
-        }
-}
-
-static inline u32 pcl_bus(const struct ti_lynx *lynx, pcl_t pclid)
-{
-        return pci_resource_start(lynx->dev, 1) + pclid * sizeof(struct ti_pcl);
-}
-
-#else /* CONFIG_IEEE1394_PCILYNX_LOCALRAM */
-
 static inline void put_pcl(const struct ti_lynx *lynx, pcl_t pclid,
                            const struct ti_pcl *pcl)
 {
@@ -431,10 +386,8 @@ static inline u32 pcl_bus(const struct ti_lynx *lynx, pcl_t pclid)
         return lynx->pcl_mem_dma + pclid * sizeof(struct ti_pcl);
 }
 
-#endif /* CONFIG_IEEE1394_PCILYNX_LOCALRAM */
-
 
-#if defined (CONFIG_IEEE1394_PCILYNX_LOCALRAM) || defined (__BIG_ENDIAN)
+#if defined (__BIG_ENDIAN)
 typedef struct ti_pcl pcltmp_t;
 
 static inline struct ti_pcl *edit_pcl(const struct ti_lynx *lynx, pcl_t pclid,
diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
index 4bedf7113f40..d68c4658f2fc 100644
--- a/drivers/ieee1394/video1394.c
+++ b/drivers/ieee1394/video1394.c
@@ -35,6 +35,11 @@
  *
  */
 
+/* Markus Tavenrath <speedygoo@speedygoo.de> :
+   - fixed checks for valid buffer-numbers in video1394_icotl
+   - changed the ways the dma prg's are used, now it's possible to use
+     even a single dma buffer
+*/
 #include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
@@ -112,6 +117,7 @@ struct dma_iso_ctx {
         struct it_dma_prg **it_prg;
 
         unsigned int *buffer_status;
+        unsigned int *buffer_prg_assignment;
         struct timeval *buffer_time; /* time when the buffer was received */
         unsigned int *last_used_cmd; /* For ISO Transmit with
                                         variable sized packets only ! */
@@ -180,23 +186,14 @@ static int free_dma_iso_ctx(struct dma_iso_ctx *d)
                 kfree(d->prg_reg);
         }
 
-        if (d->ir_prg)
-                kfree(d->ir_prg);
-
-        if (d->it_prg)
-                kfree(d->it_prg);
-
-        if (d->buffer_status)
-                kfree(d->buffer_status);
-        if (d->buffer_time)
-                kfree(d->buffer_time);
-        if (d->last_used_cmd)
-                kfree(d->last_used_cmd);
-        if (d->next_buffer)
-                kfree(d->next_buffer);
-
+        kfree(d->ir_prg);
+        kfree(d->it_prg);
+        kfree(d->buffer_status);
+        kfree(d->buffer_prg_assignment);
+        kfree(d->buffer_time);
+        kfree(d->last_used_cmd);
+        kfree(d->next_buffer);
         list_del(&d->link);
-
         kfree(d);
 
         return 0;
@@ -230,7 +227,7 @@ alloc_dma_iso_ctx(struct ti_ohci *ohci, int type, int num_desc,
         /* Init the regions for easy cleanup */
         dma_region_init(&d->dma);
 
-        if (dma_region_alloc(&d->dma, d->num_desc * d->buf_size, ohci->dev,
+        if (dma_region_alloc(&d->dma, (d->num_desc - 1) * d->buf_size, ohci->dev,
                              PCI_DMA_BIDIRECTIONAL)) {
                 PRINT(KERN_ERR, ohci->host->id, "Failed to allocate dma buffer");
                 free_dma_iso_ctx(d);
@@ -342,6 +339,8 @@ alloc_dma_iso_ctx(struct ti_ohci *ohci, int type, int num_desc,
 
         d->buffer_status = kmalloc(d->num_desc * sizeof(unsigned int),
                                    GFP_KERNEL);
+        d->buffer_prg_assignment = kmalloc(d->num_desc * sizeof(unsigned int),
+                                   GFP_KERNEL);
         d->buffer_time = kmalloc(d->num_desc * sizeof(struct timeval),
                                    GFP_KERNEL);
         d->last_used_cmd = kmalloc(d->num_desc * sizeof(unsigned int),
@@ -354,6 +353,11 @@ alloc_dma_iso_ctx(struct ti_ohci *ohci, int type, int num_desc,
                 free_dma_iso_ctx(d);
                 return NULL;
         }
+        if (d->buffer_prg_assignment == NULL) {
+                PRINT(KERN_ERR, ohci->host->id, "Failed to allocate buffer_prg_assignment");
+                free_dma_iso_ctx(d);
+                return NULL;
+        }
         if (d->buffer_time == NULL) {
                 PRINT(KERN_ERR, ohci->host->id, "Failed to allocate buffer_time");
                 free_dma_iso_ctx(d);
@@ -370,6 +374,7 @@ alloc_dma_iso_ctx(struct ti_ohci *ohci, int type, int num_desc,
                 return NULL;
         }
         memset(d->buffer_status, 0, d->num_desc * sizeof(unsigned int));
+        memset(d->buffer_prg_assignment, 0, d->num_desc * sizeof(unsigned int));
         memset(d->buffer_time, 0, d->num_desc * sizeof(struct timeval));
         memset(d->last_used_cmd, 0, d->num_desc * sizeof(unsigned int));
         memset(d->next_buffer, -1, d->num_desc * sizeof(int));
@@ -379,7 +384,7 @@ alloc_dma_iso_ctx(struct ti_ohci *ohci, int type, int num_desc,
         PRINT(KERN_INFO, ohci->host->id, "Iso %s DMA: %d buffers "
               "of size %d allocated for a frame size %d, each with %d prgs",
               (type == OHCI_ISO_RECEIVE) ? "receive" : "transmit",
-              d->num_desc, d->buf_size, d->frame_size, d->nb_cmd);
+              d->num_desc - 1, d->buf_size, d->frame_size, d->nb_cmd);
 
         return d;
 }
@@ -394,11 +399,36 @@ static void reset_ir_status(struct dma_iso_ctx *d, int n)
         d->ir_prg[n][i].status = cpu_to_le32(d->left_size);
 }
 
+static void reprogram_dma_ir_prg(struct dma_iso_ctx *d, int n, int buffer, int flags)
+{
+        struct dma_cmd *ir_prg = d->ir_prg[n];
+        unsigned long buf = (unsigned long)d->dma.kvirt + buffer * d->buf_size;
+        int i;
+
+        d->buffer_prg_assignment[n] = buffer;
+
+        ir_prg[0].address = cpu_to_le32(dma_region_offset_to_bus(&d->dma, buf -
+                                (unsigned long)d->dma.kvirt));
+        ir_prg[1].address = cpu_to_le32(dma_region_offset_to_bus(&d->dma,
+                                (buf + 4) - (unsigned long)d->dma.kvirt));
+
+        for (i=2;i<d->nb_cmd-1;i++) {
+                ir_prg[i].address = cpu_to_le32(dma_region_offset_to_bus(&d->dma,
+                                                (buf+(i-1)*PAGE_SIZE) -
+                                                (unsigned long)d->dma.kvirt));
+        }
+
+        ir_prg[i].control = cpu_to_le32(DMA_CTL_INPUT_MORE | DMA_CTL_UPDATE |
+                                  DMA_CTL_IRQ | DMA_CTL_BRANCH | d->left_size);
+        ir_prg[i].address = cpu_to_le32(dma_region_offset_to_bus(&d->dma,
+                                  (buf+(i-1)*PAGE_SIZE) - (unsigned long)d->dma.kvirt));
+}
+
 static void initialize_dma_ir_prg(struct dma_iso_ctx *d, int n, int flags)
 {
         struct dma_cmd *ir_prg = d->ir_prg[n];
         struct dma_prog_region *ir_reg = &d->prg_reg[n];
-        unsigned long buf = (unsigned long)d->dma.kvirt + n * d->buf_size;
+        unsigned long buf = (unsigned long)d->dma.kvirt;
         int i;
 
         /* the first descriptor will read only 4 bytes */
@@ -508,7 +538,7 @@ static void wakeup_dma_ir_ctx(unsigned long l)
         for (i = 0; i < d->num_desc; i++) {
                 if (d->ir_prg[i][d->nb_cmd-1].status & cpu_to_le32(0xFFFF0000)) {
                         reset_ir_status(d, i);
-                        d->buffer_status[i] = VIDEO1394_BUFFER_READY;
+                        d->buffer_status[d->buffer_prg_assignment[i]] = VIDEO1394_BUFFER_READY;
                         do_gettimeofday(&d->buffer_time[i]);
                 }
         }
@@ -585,7 +615,7 @@ static void wakeup_dma_it_ctx(unsigned long l)
                         int next = d->next_buffer[i];
                         put_timestamp(ohci, d, next);
                         d->it_prg[i][d->last_used_cmd[i]].end.status = 0;
-                        d->buffer_status[i] = VIDEO1394_BUFFER_READY;
+                        d->buffer_status[d->buffer_prg_assignment[i]] = VIDEO1394_BUFFER_READY;
                 }
         }
 
@@ -595,11 +625,25 @@ static void wakeup_dma_it_ctx(unsigned long l)
                 wake_up_interruptible(&d->waitq);
 }
 
+static void reprogram_dma_it_prg(struct dma_iso_ctx  *d, int n, int buffer)
+{
+        struct it_dma_prg *it_prg = d->it_prg[n];
+        unsigned long buf = (unsigned long)d->dma.kvirt + buffer * d->buf_size;
+        int i;
+
+        d->buffer_prg_assignment[n] = buffer;
+        for (i=0;i<d->nb_cmd;i++) {
+          it_prg[i].end.address =
+                cpu_to_le32(dma_region_offset_to_bus(&d->dma,
+                        (buf+i*d->packet_size) - (unsigned long)d->dma.kvirt));
+        }
+}
+
 static void initialize_dma_it_prg(struct dma_iso_ctx *d, int n, int sync_tag)
 {
         struct it_dma_prg *it_prg = d->it_prg[n];
         struct dma_prog_region *it_reg = &d->prg_reg[n];
-        unsigned long buf = (unsigned long)d->dma.kvirt + n * d->buf_size;
+        unsigned long buf = (unsigned long)d->dma.kvirt;
         int i;
         d->last_used_cmd[n] = d->nb_cmd - 1;
         for (i=0;i<d->nb_cmd;i++) {
@@ -796,7 +840,7 @@ static int __video1394_ioctl(struct file *file,
 
                 if (cmd == VIDEO1394_IOC_LISTEN_CHANNEL) {
                         d = alloc_dma_iso_ctx(ohci, OHCI_ISO_RECEIVE,
-                                              v.nb_buffers, v.buf_size,
+                                              v.nb_buffers + 1, v.buf_size,
                                               v.channel, 0);
 
                         if (d == NULL) {
@@ -817,7 +861,7 @@ static int __video1394_ioctl(struct file *file,
                 }
                 else {
                         d = alloc_dma_iso_ctx(ohci, OHCI_ISO_TRANSMIT,
-                                              v.nb_buffers, v.buf_size,
+                                              v.nb_buffers + 1, v.buf_size,
                                               v.channel, v.packet_size);
 
                         if (d == NULL) {
@@ -889,6 +933,7 @@ static int __video1394_ioctl(struct file *file,
         {
                 struct video1394_wait v;
                 struct dma_iso_ctx *d;
+                int next_prg;
 
                 if (copy_from_user(&v, argp, sizeof(v)))
                         return -EFAULT;
@@ -896,7 +941,7 @@ static int __video1394_ioctl(struct file *file,
                 d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
                 if (d == NULL) return -EFAULT;
 
-                if ((v.buffer<0) || (v.buffer>d->num_desc)) {
+                if ((v.buffer<0) || (v.buffer>=d->num_desc - 1)) {
                         PRINT(KERN_ERR, ohci->host->id,
                               "Buffer %d out of range",v.buffer);
                         return -EINVAL;
@@ -913,12 +958,14 @@ static int __video1394_ioctl(struct file *file,
 
                 d->buffer_status[v.buffer]=VIDEO1394_BUFFER_QUEUED;
 
+                next_prg = (d->last_buffer + 1) % d->num_desc;
                 if (d->last_buffer>=0)
                         d->ir_prg[d->last_buffer][d->nb_cmd-1].branchAddress =
-                                cpu_to_le32((dma_prog_region_offset_to_bus(&d->prg_reg[v.buffer], 0)
+                                cpu_to_le32((dma_prog_region_offset_to_bus(&d->prg_reg[next_prg], 0)
                                         & 0xfffffff0) | 0x1);
 
-                d->last_buffer = v.buffer;
+                d->last_buffer = next_prg;
+                reprogram_dma_ir_prg(d, d->last_buffer, v.buffer, d->flags);
 
                 d->ir_prg[d->last_buffer][d->nb_cmd-1].branchAddress = 0;
 
@@ -930,7 +977,7 @@ static int __video1394_ioctl(struct file *file,
 
                         /* Tell the controller where the first program is */
                         reg_write(ohci, d->cmdPtr,
-                                dma_prog_region_offset_to_bus(&d->prg_reg[v.buffer], 0) | 0x1);
+                                  dma_prog_region_offset_to_bus(&d->prg_reg[d->last_buffer], 0) | 0x1);
 
                         /* Run IR context */
                         reg_write(ohci, d->ctrlSet, 0x8000);
@@ -951,7 +998,7 @@ static int __video1394_ioctl(struct file *file,
         {
                 struct video1394_wait v;
                 struct dma_iso_ctx *d;
-                int i;
+                int i = 0;
 
                 if (copy_from_user(&v, argp, sizeof(v)))
                         return -EFAULT;
@@ -959,7 +1006,7 @@ static int __video1394_ioctl(struct file *file,
                 d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
                 if (d == NULL) return -EFAULT;
 
-                if ((v.buffer<0) || (v.buffer>d->num_desc)) {
+                if ((v.buffer<0) || (v.buffer>d->num_desc - 1)) {
                         PRINT(KERN_ERR, ohci->host->id,
                               "Buffer %d out of range",v.buffer);
                         return -EINVAL;
@@ -1005,9 +1052,9 @@ static int __video1394_ioctl(struct file *file,
                  * Look ahead to see how many more buffers have been received
                  */
                 i=0;
-                while (d->buffer_status[(v.buffer+1)%d->num_desc]==
+                while (d->buffer_status[(v.buffer+1)%(d->num_desc - 1)]==
                        VIDEO1394_BUFFER_READY) {
-                        v.buffer=(v.buffer+1)%d->num_desc;
+                        v.buffer=(v.buffer+1)%(d->num_desc - 1);
                         i++;
                 }
                 spin_unlock_irqrestore(&d->lock, flags);
@@ -1023,6 +1070,7 @@ static int __video1394_ioctl(struct file *file,
                 struct video1394_wait v;
                 unsigned int *psizes = NULL;
                 struct dma_iso_ctx *d;
+                int next_prg;
 
                 if (copy_from_user(&v, argp, sizeof(v)))
                         return -EFAULT;
@@ -1030,7 +1078,7 @@ static int __video1394_ioctl(struct file *file,
                 d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
                 if (d == NULL) return -EFAULT;
 
-                if ((v.buffer<0) || (v.buffer>d->num_desc)) {
+                if ((v.buffer<0) || (v.buffer>=d->num_desc - 1)) {
                         PRINT(KERN_ERR, ohci->host->id,
                               "Buffer %d out of range",v.buffer);
                         return -EINVAL;
@@ -1056,19 +1104,19 @@ static int __video1394_ioctl(struct file *file,
 
                 spin_lock_irqsave(&d->lock,flags);
 
+                // last_buffer is last_prg
+                next_prg = (d->last_buffer + 1) % d->num_desc;
                 if (d->buffer_status[v.buffer]!=VIDEO1394_BUFFER_FREE) {
                         PRINT(KERN_ERR, ohci->host->id,
                               "Buffer %d is already used",v.buffer);
                         spin_unlock_irqrestore(&d->lock,flags);
-                        if (psizes)
-                                kfree(psizes);
+                        kfree(psizes);
                         return -EBUSY;
                 }
 
                 if (d->flags & VIDEO1394_VARIABLE_PACKET_SIZE) {
                         initialize_dma_it_prg_var_packet_queue(
-                                d, v.buffer, psizes,
-                                ohci);
+                                d, next_prg, psizes, ohci);
                 }
 
                 d->buffer_status[v.buffer]=VIDEO1394_BUFFER_QUEUED;
@@ -1076,16 +1124,17 @@ static int __video1394_ioctl(struct file *file,
                 if (d->last_buffer >= 0) {
                         d->it_prg[d->last_buffer]
                                 [ d->last_used_cmd[d->last_buffer] ].end.branchAddress =
-                                        cpu_to_le32((dma_prog_region_offset_to_bus(&d->prg_reg[v.buffer],
+                                        cpu_to_le32((dma_prog_region_offset_to_bus(&d->prg_reg[next_prg],
                                                 0) & 0xfffffff0) | 0x3);
 
                         d->it_prg[d->last_buffer]
                                 [ d->last_used_cmd[d->last_buffer] ].begin.branchAddress =
-                                        cpu_to_le32((dma_prog_region_offset_to_bus(&d->prg_reg[v.buffer],
+                                        cpu_to_le32((dma_prog_region_offset_to_bus(&d->prg_reg[next_prg],
                                                 0) & 0xfffffff0) | 0x3);
-                        d->next_buffer[d->last_buffer] = v.buffer;
+                        d->next_buffer[d->last_buffer] = (v.buffer + 1) % (d->num_desc - 1);
                 }
-                d->last_buffer = v.buffer;
+                d->last_buffer = next_prg;
+                reprogram_dma_it_prg(d, d->last_buffer, v.buffer);
                 d->next_buffer[d->last_buffer] = -1;
 
                 d->it_prg[d->last_buffer][d->last_used_cmd[d->last_buffer]].end.branchAddress = 0;
@@ -1100,7 +1149,7 @@ static int __video1394_ioctl(struct file *file,
 
                         /* Tell the controller where the first program is */
                         reg_write(ohci, d->cmdPtr,
-                                dma_prog_region_offset_to_bus(&d->prg_reg[v.buffer], 0) | 0x3);
+                                dma_prog_region_offset_to_bus(&d->prg_reg[next_prg], 0) | 0x3);
 
                         /* Run IT context */
                         reg_write(ohci, d->ctrlSet, 0x8000);
@@ -1116,9 +1165,7 @@ static int __video1394_ioctl(struct file *file,
                         }
                 }
 
-                if (psizes)
-                        kfree(psizes);
-
+                kfree(psizes);
                 return 0;
 
         }
@@ -1133,7 +1180,7 @@ static int __video1394_ioctl(struct file *file,
                 d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
                 if (d == NULL) return -EFAULT;
 
-                if ((v.buffer<0) || (v.buffer>d->num_desc)) {
+                if ((v.buffer<0) || (v.buffer>=d->num_desc-1)) {
                         PRINT(KERN_ERR, ohci->host->id,
                               "Buffer %d out of range",v.buffer);
                         return -EINVAL;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index ff66ed4ee2cd..79c332f16fc7 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -465,8 +465,10 @@ static int atkbd_event(struct input_dev *dev, unsigned int type, unsigned int co
                         if (atkbd->softrepeat) return 0;
 
                         i = j = 0;
-                        while (i < 32 && period[i] < dev->rep[REP_PERIOD]) i++;
-                        while (j < 4 && delay[j] < dev->rep[REP_DELAY]) j++;
+                        while (i < 31 && period[i] < dev->rep[REP_PERIOD])
+                                i++;
+                        while (j < 3 && delay[j] < dev->rep[REP_DELAY])
+                                j++;
                         dev->rep[REP_PERIOD] = period[i];
                         dev->rep[REP_DELAY] = delay[j];
                         param[0] = i | (j << 5);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 1f85a9718c89..42a9f7f6f8cb 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -341,6 +341,8 @@ static int alps_reconnect(struct psmouse *psmouse)
         unsigned char param[4];
         int version;
 
+        psmouse_reset(psmouse);
+
         if (!(priv->i = alps_get_model(psmouse, &version)))
                 return -1;
 
@@ -395,7 +397,7 @@ int alps_init(struct psmouse *psmouse)
         }
 
         if (param[0] & 0x04) {
-                printk(KERN_INFO "  Enabling hardware tapping\n");
+                printk(KERN_INFO "alps.c: Enabling hardware tapping\n");
                 if (alps_tap_mode(psmouse, 1))
                         printk(KERN_WARNING "alps.c: Failed to enable hardware tapping\n");
         }
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 3313e2daeab0..0beacb77ee18 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -388,6 +388,24 @@ static ssize_t serio_show_id_extra(struct device *dev, char *buf)
         return sprintf(buf, "%02x\n", serio->id.extra);
 }
 
+static DEVICE_ATTR(type, S_IRUGO, serio_show_id_type, NULL);
+static DEVICE_ATTR(proto, S_IRUGO, serio_show_id_proto, NULL);
+static DEVICE_ATTR(id, S_IRUGO, serio_show_id_id, NULL);
+static DEVICE_ATTR(extra, S_IRUGO, serio_show_id_extra, NULL);
+
+static struct attribute *serio_device_id_attrs[] = {
+        &dev_attr_type.attr,
+        &dev_attr_proto.attr,
+        &dev_attr_id.attr,
+        &dev_attr_extra.attr,
+        NULL
+};
+
+static struct attribute_group serio_id_attr_group = {
+        .name   = "id",
+        .attrs  = serio_device_id_attrs,
+};
+
 static ssize_t serio_rebind_driver(struct device *dev, const char *buf, size_t count)
 {
         struct serio *serio = to_serio_port(dev);
@@ -444,10 +462,6 @@ static ssize_t serio_set_bind_mode(struct device *dev, const char *buf, size_t c
 
 static struct device_attribute serio_device_attrs[] = {
         __ATTR(description, S_IRUGO, serio_show_description, NULL),
-        __ATTR(id_type, S_IRUGO, serio_show_id_type, NULL),
-        __ATTR(id_proto, S_IRUGO, serio_show_id_proto, NULL),
-        __ATTR(id_id, S_IRUGO, serio_show_id_id, NULL),
-        __ATTR(id_extra, S_IRUGO, serio_show_id_extra, NULL),
         __ATTR(drvctl, S_IWUSR, NULL, serio_rebind_driver),
         __ATTR(bind_mode, S_IWUSR | S_IRUGO, serio_show_bind_mode, serio_set_bind_mode),
         __ATTR_NULL
@@ -498,6 +512,7 @@ static void serio_add_port(struct serio *serio)
         if (serio->start)
                 serio->start(serio);
         device_add(&serio->dev);
+        sysfs_create_group(&serio->dev.kobj, &serio_id_attr_group);
         serio->registered = 1;
 }
 
@@ -526,6 +541,7 @@ static void serio_destroy_port(struct serio *serio)
         }
 
         if (serio->registered) {
+                sysfs_remove_group(&serio->dev.kobj, &serio_id_attr_group);
                 device_del(&serio->dev);
                 list_del_init(&serio->node);
                 serio->registered = 0;
@@ -779,7 +795,6 @@ static int serio_resume(struct device *dev)
         struct serio *serio = to_serio_port(dev);
 
         if (!serio->drv || !serio->drv->reconnect || serio->drv->reconnect(serio)) {
-                serio_disconnect_port(serio);
                 /*
                  * Driver re-probing can take a while, so better let kseriod
                  * deal with it.
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 22f73683952b..f6b85222ba3d 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -27,11 +27,15 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS_LDISC(N_MOUSE);
 
 #define SERPORT_BUSY    1
+#define SERPORT_ACTIVE  2
+#define SERPORT_DEAD    3
 
 struct serport {
         struct tty_struct *tty;
         wait_queue_head_t wait;
         struct serio *serio;
+        struct serio_device_id id;
+        spinlock_t lock;
         unsigned long flags;
 };
 
@@ -45,11 +49,29 @@ static int serport_serio_write(struct serio *serio, unsigned char data)
         return -(serport->tty->driver->write(serport->tty, &data, 1) != 1);
 }
 
+static int serport_serio_open(struct serio *serio)
+{
+        struct serport *serport = serio->port_data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&serport->lock, flags);
+        set_bit(SERPORT_ACTIVE, &serport->flags);
+        spin_unlock_irqrestore(&serport->lock, flags);
+
+        return 0;
+}
+
+
 static void serport_serio_close(struct serio *serio)
 {
         struct serport *serport = serio->port_data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&serport->lock, flags);
+        clear_bit(SERPORT_ACTIVE, &serport->flags);
+        set_bit(SERPORT_DEAD, &serport->flags);
+        spin_unlock_irqrestore(&serport->lock, flags);
 
-        serport->serio->id.type = 0;
         wake_up_interruptible(&serport->wait);
 }
 
@@ -61,36 +83,21 @@ static void serport_serio_close(struct serio *serio)
 static int serport_ldisc_open(struct tty_struct *tty)
 {
         struct serport *serport;
-        struct serio *serio;
-        char name[64];
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        serport = kmalloc(sizeof(struct serport), GFP_KERNEL);
-        serio = kmalloc(sizeof(struct serio), GFP_KERNEL);
-        if (unlikely(!serport || !serio)) {
-                kfree(serport);
-                kfree(serio);
+        serport = kcalloc(1, sizeof(struct serport), GFP_KERNEL);
+        if (!serport)
                 return -ENOMEM;
-        }
 
-        memset(serport, 0, sizeof(struct serport));
-        serport->serio = serio;
-        set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
         serport->tty = tty;
-        tty->disc_data = serport;
-
-        memset(serio, 0, sizeof(struct serio));
-        strlcpy(serio->name, "Serial port", sizeof(serio->name));
-        snprintf(serio->phys, sizeof(serio->phys), "%s/serio0", tty_name(tty, name));
-        serio->id.type = SERIO_RS232;
-        serio->write = serport_serio_write;
-        serio->close = serport_serio_close;
-        serio->port_data = serport;
-
+        spin_lock_init(&serport->lock);
         init_waitqueue_head(&serport->wait);
 
+        tty->disc_data = serport;
+        set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+
         return 0;
 }
 
@@ -100,7 +107,8 @@ static int serport_ldisc_open(struct tty_struct *tty)
 
 static void serport_ldisc_close(struct tty_struct *tty)
 {
-        struct serport *serport = (struct serport*) tty->disc_data;
+        struct serport *serport = (struct serport *) tty->disc_data;
+
         kfree(serport);
 }
 
@@ -116,9 +124,19 @@ static void serport_ldisc_close(struct tty_struct *tty)
 static void serport_ldisc_receive(struct tty_struct *tty, const unsigned char *cp, char *fp, int count)
 {
         struct serport *serport = (struct serport*) tty->disc_data;
+        unsigned long flags;
         int i;
+
+        spin_lock_irqsave(&serport->lock, flags);
+
+        if (!test_bit(SERPORT_ACTIVE, &serport->flags))
+                goto out;
+
         for (i = 0; i < count; i++)
                 serio_interrupt(serport->serio, cp[i], 0, NULL);
+
+out:
+        spin_unlock_irqrestore(&serport->lock, flags);
 }
 
 /*
@@ -141,16 +159,33 @@ static int serport_ldisc_room(struct tty_struct *tty)
 static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, unsigned char __user * buf, size_t nr)
 {
         struct serport *serport = (struct serport*) tty->disc_data;
+        struct serio *serio;
         char name[64];
 
         if (test_and_set_bit(SERPORT_BUSY, &serport->flags))
                 return -EBUSY;
 
+        serport->serio = serio = kcalloc(1, sizeof(struct serio), GFP_KERNEL);
+        if (!serio)
+                return -ENOMEM;
+
+        strlcpy(serio->name, "Serial port", sizeof(serio->name));
+        snprintf(serio->phys, sizeof(serio->phys), "%s/serio0", tty_name(tty, name));
+        serio->id = serport->id;
+        serio->id.type = SERIO_RS232;
+        serio->write = serport_serio_write;
+        serio->open = serport_serio_open;
+        serio->close = serport_serio_close;
+        serio->port_data = serport;
+
         serio_register_port(serport->serio);
         printk(KERN_INFO "serio: Serial port %s\n", tty_name(tty, name));
-        wait_event_interruptible(serport->wait, !serport->serio->id.type);
+
+        wait_event_interruptible(serport->wait, test_bit(SERPORT_DEAD, &serport->flags));
         serio_unregister_port(serport->serio);
+        serport->serio = NULL;
 
+        clear_bit(SERPORT_DEAD, &serport->flags);
         clear_bit(SERPORT_BUSY, &serport->flags);
 
         return 0;
@@ -163,16 +198,15 @@ static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, u
 static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg)
 {
         struct serport *serport = (struct serport*) tty->disc_data;
-        struct serio *serio = serport->serio;
         unsigned long type;
 
         if (cmd == SPIOCSTYPE) {
                 if (get_user(type, (unsigned long __user *) arg))
                         return -EFAULT;
 
-                serio->id.proto = type & 0x000000ff;
-                serio->id.id    = (type & 0x0000ff00) >> 8;
-                serio->id.extra = (type & 0x00ff0000) >> 16;
+                serport->id.proto = type & 0x000000ff;
+                serport->id.id    = (type & 0x0000ff00) >> 8;
+                serport->id.extra = (type & 0x00ff0000) >> 16;
 
                 return 0;
         }
@@ -182,9 +216,13 @@ static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsi
 
 static void serport_ldisc_write_wakeup(struct tty_struct * tty)
 {
-        struct serport *sp = (struct serport *) tty->disc_data;
+        struct serport *serport = (struct serport *) tty->disc_data;
+        unsigned long flags;
 
-        serio_drv_write_wakeup(sp->serio);
+        spin_lock_irqsave(&serport->lock, flags);
+        if (test_bit(SERPORT_ACTIVE, &serport->flags))
+                serio_drv_write_wakeup(serport->serio);
+        spin_unlock_irqrestore(&serport->lock, flags);
 }
 
 /*
diff --git a/drivers/md/dm-emc.c b/drivers/md/dm-emc.c
index 700658664594..c7067674dcb7 100644
--- a/drivers/md/dm-emc.c
+++ b/drivers/md/dm-emc.c
@@ -223,8 +223,10 @@ static struct emc_handler *alloc_emc_handler(void)
 {
         struct emc_handler *h = kmalloc(sizeof(*h), GFP_KERNEL);
 
-        if (h)
+        if (h) {
+                memset(h, 0, sizeof(*h));
                 spin_lock_init(&h->lock);
+        }
 
         return h;
 }
@@ -259,8 +261,6 @@ static int emc_create(struct hw_handler *hwh, unsigned argc, char **argv)
         if (!h)
                 return -ENOMEM;
 
-        memset(h, 0, sizeof(*h));
-
         hwh->context = h;
 
         if ((h->short_trespass = short_trespass))
diff --git a/drivers/md/dm-hw-handler.c b/drivers/md/dm-hw-handler.c
index ae63772e44c9..4cc0010e0156 100644
--- a/drivers/md/dm-hw-handler.c
+++ b/drivers/md/dm-hw-handler.c
@@ -23,7 +23,7 @@ struct hwh_internal {
 static LIST_HEAD(_hw_handlers);
 static DECLARE_RWSEM(_hwh_lock);
 
-struct hwh_internal *__find_hw_handler_type(const char *name)
+static struct hwh_internal *__find_hw_handler_type(const char *name)
 {
         struct hwh_internal *hwhi;
 
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 43763a0bd096..1e97b3c12bd5 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -101,6 +101,7 @@ typedef int (*action_fn) (struct pgpath *pgpath);
 
 static kmem_cache_t *_mpio_cache;
 
+struct workqueue_struct *kmultipathd;
 static void process_queued_ios(void *data);
 static void trigger_event(void *data);
 
@@ -308,7 +309,7 @@ static int map_io(struct multipath *m, struct bio *bio, struct mpath_io *mpio,
                 bio_list_add(&m->queued_ios, bio);
                 m->queue_size++;
                 if (m->pg_init_required || !m->queue_io)
-                        schedule_work(&m->process_queued_ios);
+                        queue_work(kmultipathd, &m->process_queued_ios);
                 pgpath = NULL;
                 r = 0;
         } else if (!pgpath)
@@ -334,7 +335,7 @@ static int queue_if_no_path(struct multipath *m, unsigned queue_if_no_path)
 
         m->queue_if_no_path = queue_if_no_path;
         if (!m->queue_if_no_path)
-                schedule_work(&m->process_queued_ios);
+                queue_work(kmultipathd, &m->process_queued_ios);
 
         spin_unlock_irqrestore(&m->lock, flags);
 
@@ -800,7 +801,7 @@ static int fail_path(struct pgpath *pgpath)
         if (pgpath == m->current_pgpath)
                 m->current_pgpath = NULL;
 
-        schedule_work(&m->trigger_event);
+        queue_work(kmultipathd, &m->trigger_event);
 
 out:
         spin_unlock_irqrestore(&m->lock, flags);
@@ -837,9 +838,9 @@ static int reinstate_path(struct pgpath *pgpath)
 
         m->current_pgpath = NULL;
         if (!m->nr_valid_paths++)
-                schedule_work(&m->process_queued_ios);
+                queue_work(kmultipathd, &m->process_queued_ios);
 
-        schedule_work(&m->trigger_event);
+        queue_work(kmultipathd, &m->trigger_event);
 
 out:
         spin_unlock_irqrestore(&m->lock, flags);
@@ -883,7 +884,7 @@ static void bypass_pg(struct multipath *m, struct priority_group *pg,
 
         spin_unlock_irqrestore(&m->lock, flags);
 
-        schedule_work(&m->trigger_event);
+        queue_work(kmultipathd, &m->trigger_event);
 }
 
 /*
@@ -913,7 +914,7 @@ static int switch_pg_num(struct multipath *m, const char *pgstr)
         }
         spin_unlock_irqrestore(&m->lock, flags);
 
-        schedule_work(&m->trigger_event);
+        queue_work(kmultipathd, &m->trigger_event);
         return 0;
 }
 
@@ -968,7 +969,7 @@ void dm_pg_init_complete(struct path *path, unsigned err_flags)
                 m->current_pgpath = NULL;
                 m->current_pg = NULL;
         }
-        schedule_work(&m->process_queued_ios);
+        queue_work(kmultipathd, &m->process_queued_ios);
         spin_unlock_irqrestore(&m->lock, flags);
 }
 
@@ -1018,7 +1019,7 @@ static int do_end_io(struct multipath *m, struct bio *bio,
         bio_list_add(&m->queued_ios, bio);
         m->queue_size++;
         if (!m->queue_io)
-                schedule_work(&m->process_queued_ios);
+                queue_work(kmultipathd, &m->process_queued_ios);
         spin_unlock(&m->lock);
 
         return 1;       /* io not complete */
@@ -1057,7 +1058,7 @@ static void multipath_presuspend(struct dm_target *ti)
         spin_lock_irqsave(&m->lock, flags);
         m->suspended = 1;
         if (m->queue_if_no_path)
-                schedule_work(&m->process_queued_ios);
+                queue_work(kmultipathd, &m->process_queued_ios);
         spin_unlock_irqrestore(&m->lock, flags);
 }
 
@@ -1274,6 +1275,15 @@ static int __init dm_multipath_init(void)
                 return -EINVAL;
         }
 
+        kmultipathd = create_workqueue("kmpathd");
+        if (!kmultipathd) {
+                DMERR("%s: failed to create workqueue kmpathd",
+                                multipath_target.name);
+                dm_unregister_target(&multipath_target);
+                kmem_cache_destroy(_mpio_cache);
+                return -ENOMEM;
+        }
+
         DMINFO("dm-multipath version %u.%u.%u loaded",
                multipath_target.version[0], multipath_target.version[1],
                multipath_target.version[2]);
@@ -1285,6 +1295,8 @@ static void __exit dm_multipath_exit(void)
 {
         int r;
 
+        destroy_workqueue(kmultipathd);
+
         r = dm_unregister_target(&multipath_target);
         if (r < 0)
                 DMERR("%s: target unregister failed %d",
diff --git a/drivers/md/dm-path-selector.c b/drivers/md/dm-path-selector.c
index ac5c4bbec6c1..a28c1c2b4ef5 100644
--- a/drivers/md/dm-path-selector.c
+++ b/drivers/md/dm-path-selector.c
@@ -26,7 +26,7 @@ struct ps_internal {
 static LIST_HEAD(_path_selectors);
 static DECLARE_RWSEM(_ps_lock);
 
-struct ps_internal *__find_path_selector_type(const char *name)
+static struct ps_internal *__find_path_selector_type(const char *name)
 {
         struct ps_internal *psi;
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index ee175d4906c4..18e9b9953fcd 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -242,7 +242,7 @@ static void free_devices(struct list_head *devices)
         }
 }
 
-void table_destroy(struct dm_table *t)
+static void table_destroy(struct dm_table *t)
 {
         unsigned int i;
 
diff --git a/drivers/md/dm-zero.c b/drivers/md/dm-zero.c
index 7febc2cac73d..51c0639b2487 100644
--- a/drivers/md/dm-zero.c
+++ b/drivers/md/dm-zero.c
@@ -55,7 +55,7 @@ static struct target_type zero_target = {
         .map    = zero_map,
 };
 
-int __init dm_zero_init(void)
+static int __init dm_zero_init(void)
 {
         int r = dm_register_target(&zero_target);
 
@@ -65,7 +65,7 @@ int __init dm_zero_init(void)
         return r;
 }
 
-void __exit dm_zero_exit(void)
+static void __exit dm_zero_exit(void)
 {
         int r = dm_unregister_target(&zero_target);
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 243ff6884e83..f6b03957efc7 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -97,6 +97,7 @@ struct mapped_device {
          * freeze/thaw support require holding onto a super block
          */
         struct super_block *frozen_sb;
+        struct block_device *frozen_bdev;
 };
 
 #define MIN_IOS 256
@@ -990,44 +991,50 @@ int dm_swap_table(struct mapped_device *md, struct dm_table *table)
  */
 static int __lock_fs(struct mapped_device *md)
 {
-        struct block_device *bdev;
+        int error = -ENOMEM;
 
         if (test_and_set_bit(DMF_FS_LOCKED, &md->flags))
                 return 0;
 
-        bdev = bdget_disk(md->disk, 0);
-        if (!bdev) {
+        md->frozen_bdev = bdget_disk(md->disk, 0);
+        if (!md->frozen_bdev) {
                 DMWARN("bdget failed in __lock_fs");
-                return -ENOMEM;
+                goto out;
         }
 
         WARN_ON(md->frozen_sb);
-        md->frozen_sb = freeze_bdev(bdev);
+
+        md->frozen_sb = freeze_bdev(md->frozen_bdev);
+        if (IS_ERR(md->frozen_sb)) {
+                error = PTR_ERR(md->frozen_sb);
+                goto out_bdput;
+        }
+
         /* don't bdput right now, we don't want the bdev
          * to go away while it is locked.  We'll bdput
          * in __unlock_fs
          */
         return 0;
+
+out_bdput:
+        bdput(md->frozen_bdev);
+        md->frozen_sb = NULL;
+        md->frozen_bdev = NULL;
+out:
+        clear_bit(DMF_FS_LOCKED, &md->flags);
+        return error;
 }
 
-static int __unlock_fs(struct mapped_device *md)
+static void __unlock_fs(struct mapped_device *md)
 {
-        struct block_device *bdev;
-
         if (!test_and_clear_bit(DMF_FS_LOCKED, &md->flags))
-                return 0;
+                return;
 
-        bdev = bdget_disk(md->disk, 0);
-        if (!bdev) {
-                DMWARN("bdget failed in __unlock_fs");
-                return -ENOMEM;
-        }
+        thaw_bdev(md->frozen_bdev, md->frozen_sb);
+        bdput(md->frozen_bdev);
 
-        thaw_bdev(bdev, md->frozen_sb);
         md->frozen_sb = NULL;
-        bdput(bdev);
-        bdput(bdev);
-        return 0;
+        md->frozen_bdev = NULL;
 }
 
 /*
@@ -1041,37 +1048,37 @@ int dm_suspend(struct mapped_device *md)
 {
         struct dm_table *map;
         DECLARE_WAITQUEUE(wait, current);
+        int error = -EINVAL;
 
         /* Flush I/O to the device. */
         down_read(&md->lock);
-        if (test_bit(DMF_BLOCK_IO, &md->flags)) {
-                up_read(&md->lock);
-                return -EINVAL;
-        }
+        if (test_bit(DMF_BLOCK_IO, &md->flags))
+                goto out_read_unlock;
+
+        error = __lock_fs(md);
+        if (error)
+                goto out_read_unlock;
 
         map = dm_get_table(md);
         if (map)
                 dm_table_presuspend_targets(map);
-        __lock_fs(md);
 
         up_read(&md->lock);
 
         /*
-         * First we set the BLOCK_IO flag so no more ios will be
-         * mapped.
+         * First we set the BLOCK_IO flag so no more ios will be mapped.
+         *
+         * If the flag is already set we know another thread is trying to
+         * suspend as well, so we leave the fs locked for this thread.
          */
+        error = -EINVAL;
         down_write(&md->lock);
-        if (test_bit(DMF_BLOCK_IO, &md->flags)) {
-                /*
-                 * If we get here we know another thread is
-                 * trying to suspend as well, so we leave the fs
-                 * locked for this thread.
-                 */
-                up_write(&md->lock);
-                return -EINVAL;
+        if (test_and_set_bit(DMF_BLOCK_IO, &md->flags)) {
+                if (map)
+                        dm_table_put(map);
+                goto out_write_unlock;
         }
 
-        set_bit(DMF_BLOCK_IO, &md->flags);
         add_wait_queue(&md->wait, &wait);
         up_write(&md->lock);
 
@@ -1099,12 +1106,9 @@ int dm_suspend(struct mapped_device *md)
         remove_wait_queue(&md->wait, &wait);
 
         /* were we interrupted ? */
-        if (atomic_read(&md->pending)) {
-                __unlock_fs(md);
-                clear_bit(DMF_BLOCK_IO, &md->flags);
-                up_write(&md->lock);
-                return -EINTR;
-        }
+        error = -EINTR;
+        if (atomic_read(&md->pending))
+                goto out_unfreeze;
 
         set_bit(DMF_SUSPENDED, &md->flags);
 
@@ -1115,6 +1119,18 @@ int dm_suspend(struct mapped_device *md)
         up_write(&md->lock);
 
         return 0;
+
+out_unfreeze:
+        /* FIXME Undo dm_table_presuspend_targets */
+        __unlock_fs(md);
+        clear_bit(DMF_BLOCK_IO, &md->flags);
+out_write_unlock:
+        up_write(&md->lock);
+        return error;
+
+out_read_unlock:
+        up_read(&md->lock);
+        return error;
 }
 
 int dm_resume(struct mapped_device *md)
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 161e9aa87291..b1941b887f46 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -269,9 +269,8 @@ static int linear_make_request (request_queue_t *q, struct bio *bio)
                  * split it.
                  */
                 struct bio_pair *bp;
-                bp = bio_split(bio, bio_split_pool, 
-                               (bio->bi_sector + (bio->bi_size >> 9) -
-                                (tmp_dev->offset + tmp_dev->size))<<1);
+                bp = bio_split(bio, bio_split_pool,
+                               ((tmp_dev->offset + tmp_dev->size)<<1) - bio->bi_sector);
                 if (linear_make_request(q, &bp->bio1))
                         generic_make_request(&bp->bio1);
                 if (linear_make_request(q, &bp->bio2))
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 97af857d8a88..d899204d3743 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -957,7 +957,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
 }
 
 
-struct super_type super_types[] = {
+static struct super_type super_types[] = {
         [0] = {
                 .name   = "0.90.0",
                 .owner  = THIS_MODULE,
@@ -2740,7 +2740,7 @@ static struct block_device_operations md_fops =
         .revalidate_disk= md_revalidate,
 };
 
-int md_thread(void * arg)
+static int md_thread(void * arg)
 {
         mdk_thread_t *thread = arg;
 
@@ -3232,7 +3232,7 @@ void md_handle_safemode(mddev_t *mddev)
 }
 
 
-DECLARE_WAIT_QUEUE_HEAD(resync_wait);
+static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
 
 #define SYNC_MARKS      10
 #define SYNC_MARK_STEP  (3*HZ)
@@ -3575,8 +3575,8 @@ void md_check_recovery(mddev_t *mddev)
         }
 }
 
-int md_notify_reboot(struct notifier_block *this,
-                                        unsigned long code, void *x)
+static int md_notify_reboot(struct notifier_block *this,
+                            unsigned long code, void *x)
 {
         struct list_head *tmp;
         mddev_t *mddev;
@@ -3599,7 +3599,7 @@ int md_notify_reboot(struct notifier_block *this,
         return NOTIFY_DONE;
 }
 
-struct notifier_block md_notifier = {
+static struct notifier_block md_notifier = {
         .notifier_call  = md_notify_reboot,
         .next           = NULL,
         .priority       = INT_MAX, /* before any real devices */
@@ -3616,7 +3616,7 @@ static void md_geninit(void)
                 p->proc_fops = &md_seq_fops;
 }
 
-int __init md_init(void)
+static int __init md_init(void)
 {
         int minor;
 
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 1891e4930dcc..2ae2d709cb15 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -103,7 +103,8 @@ static void multipath_end_bh_io (struct multipath_bh *mp_bh, int err)
         mempool_free(mp_bh, conf->pool);
 }
 
-int multipath_end_request(struct bio *bio, unsigned int bytes_done, int error)
+static int multipath_end_request(struct bio *bio, unsigned int bytes_done,
+                                 int error)
 {
         int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
         struct multipath_bh * mp_bh = (struct multipath_bh *)(bio->bi_private);
@@ -461,10 +462,6 @@ static int multipath_run (mddev_t *mddev)
         }
         memset(conf->multipaths, 0, sizeof(struct multipath_info)*mddev->raid_disks);
 
-        mddev->queue->unplug_fn = multipath_unplug;
-
-        mddev->queue->issue_flush_fn = multipath_issue_flush;
-
         conf->working_disks = 0;
         ITERATE_RDEV(mddev,rdev,tmp) {
                 disk_idx = rdev->raid_disk;
@@ -527,6 +524,10 @@ static int multipath_run (mddev_t *mddev)
          * Ok, everything is just fine now
          */
         mddev->array_size = mddev->size;
+
+        mddev->queue->unplug_fn = multipath_unplug;
+        mddev->queue->issue_flush_fn = multipath_issue_flush;
+
         return 0;
 
 out_free_conf:
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 83380b5d6593..1db5de52d376 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1197,10 +1197,6 @@ static int run(mddev_t *mddev)
         if (!conf->r1bio_pool)
                 goto out_no_mem;
 
-        mddev->queue->unplug_fn = raid1_unplug;
-
-        mddev->queue->issue_flush_fn = raid1_issue_flush;
-
         ITERATE_RDEV(mddev, rdev, tmp) {
                 disk_idx = rdev->raid_disk;
                 if (disk_idx >= mddev->raid_disks
@@ -1282,6 +1278,9 @@ static int run(mddev_t *mddev)
          */
         mddev->array_size = mddev->size;
 
+        mddev->queue->unplug_fn = raid1_unplug;
+        mddev->queue->issue_flush_fn = raid1_issue_flush;
+
         return 0;
 
 out_no_mem:
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index e9dc2876a626..3c37be6423d7 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1639,9 +1639,6 @@ static int run(mddev_t *mddev)
                         mdname(mddev));
                 goto out_free_conf;
         }
-        mddev->queue->unplug_fn = raid10_unplug;
-
-        mddev->queue->issue_flush_fn = raid10_issue_flush;
 
         ITERATE_RDEV(mddev, rdev, tmp) {
                 disk_idx = rdev->raid_disk;
@@ -1713,6 +1710,9 @@ static int run(mddev_t *mddev)
         mddev->array_size = size/2;
         mddev->resync_max_sectors = size;
 
+        mddev->queue->unplug_fn = raid10_unplug;
+        mddev->queue->issue_flush_fn = raid10_issue_flush;
+
         /* Calculate max read-ahead size.
          * We need to readahead at least twice a whole stripe....
          * maybe...
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e96e2a10a9c9..3cb11ac232fa 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1620,9 +1620,6 @@ static int run (mddev_t *mddev)
         atomic_set(&conf->active_stripes, 0);
         atomic_set(&conf->preread_active_stripes, 0);
 
-        mddev->queue->unplug_fn = raid5_unplug_device;
-        mddev->queue->issue_flush_fn = raid5_issue_flush;
-
         PRINTK("raid5: run(%s) called.\n", mdname(mddev));
 
         ITERATE_RDEV(mddev,rdev,tmp) {
@@ -1728,6 +1725,10 @@ memory = conf->max_nr_stripes * (sizeof(struct stripe_head) +
         }
 
         /* Ok, everything is just fine now */
+
+        mddev->queue->unplug_fn = raid5_unplug_device;
+        mddev->queue->issue_flush_fn = raid5_issue_flush;
+
         mddev->array_size =  mddev->size * (mddev->raid_disks - 1);
         return 0;
 abort:
diff --git a/drivers/md/raid6main.c b/drivers/md/raid6main.c
index 8a33f351e092..908edd78a792 100644
--- a/drivers/md/raid6main.c
+++ b/drivers/md/raid6main.c
@@ -1779,9 +1779,6 @@ static int run (mddev_t *mddev)
         atomic_set(&conf->active_stripes, 0);
         atomic_set(&conf->preread_active_stripes, 0);
 
-        mddev->queue->unplug_fn = raid6_unplug_device;
-        mddev->queue->issue_flush_fn = raid6_issue_flush;
-
         PRINTK("raid6: run(%s) called.\n", mdname(mddev));
 
         ITERATE_RDEV(mddev,rdev,tmp) {
@@ -1895,6 +1892,9 @@ static int run (mddev_t *mddev)
 
         /* Ok, everything is just fine now */
         mddev->array_size =  mddev->size * (mddev->raid_disks - 2);
+
+        mddev->queue->unplug_fn = raid6_unplug_device;
+        mddev->queue->issue_flush_fn = raid6_issue_flush;
         return 0;
 abort:
         if (conf) {
diff --git a/drivers/media/common/saa7146_core.c b/drivers/media/common/saa7146_core.c
index 9f6c19ac1285..50e8b8654018 100644
--- a/drivers/media/common/saa7146_core.c
+++ b/drivers/media/common/saa7146_core.c
@@ -23,9 +23,9 @@
 LIST_HEAD(saa7146_devices);
 DECLARE_MUTEX(saa7146_devices_lock);
 
-static int saa7146_num = 0;
+static int saa7146_num;
 
-unsigned int saa7146_debug = 0;
+unsigned int saa7146_debug;
 
 module_param(saa7146_debug, int, 0644);
 MODULE_PARM_DESC(saa7146_debug, "debug level (default: 0)");
diff --git a/drivers/media/dvb/Kconfig b/drivers/media/dvb/Kconfig
index 883ec08490f4..4983e1b1bb1d 100644
--- a/drivers/media/dvb/Kconfig
+++ b/drivers/media/dvb/Kconfig
@@ -33,7 +33,7 @@ source "drivers/media/dvb/dibusb/Kconfig"
 source "drivers/media/dvb/cinergyT2/Kconfig"
 
 comment "Supported FlexCopII (B2C2) Adapters"
-        depends on DVB_CORE && PCI
+        depends on DVB_CORE && (PCI || USB)
 source "drivers/media/dvb/b2c2/Kconfig"
 
 comment "Supported BT878 Adapters"
diff --git a/drivers/media/dvb/b2c2/Kconfig b/drivers/media/dvb/b2c2/Kconfig
index 52596907a0be..99bd675df955 100644
--- a/drivers/media/dvb/b2c2/Kconfig
+++ b/drivers/media/dvb/b2c2/Kconfig
@@ -1,26 +1,50 @@
-config DVB_B2C2_SKYSTAR
-        tristate "B2C2/Technisat Air/Sky/CableStar 2 PCI"
-        depends on DVB_CORE && PCI
+config DVB_B2C2_FLEXCOP
+        tristate "Technisat/B2C2 FlexCopII(b) and FlexCopIII adapters"
+        depends on DVB_CORE
         select DVB_STV0299
         select DVB_MT352
         select DVB_MT312
         select DVB_NXT2002
+        select DVB_STV0297
         help
-          Support for the Skystar2 PCI DVB card by Technisat, which
-          is equipped with the FlexCopII chipset by B2C2, and
-          for the B2C2/BBTI Air2PC-ATSC card.
+          Support for the digital TV receiver chip made by B2C2 Inc. included in
+          Technisats PCI cards and USB boxes.
 
           Say Y if you own such a device and want to use it.
 
-config DVB_B2C2_USB
-        tristate "B2C2/Technisat Air/Sky/Cable2PC USB"
-        depends on DVB_CORE && USB && EXPERIMENTAL
+config DVB_B2C2_FLEXCOP_PCI
+        tristate "Technisat/B2C2 Air/Sky/Cable2PC PCI"
+        depends on DVB_B2C2_FLEXCOP && PCI
+        help
+          Support for the Air/Sky/CableStar2 PCI card (DVB/ATSC) by Technisat/B2C2.
+
+          Say Y if you own such a device and want to use it.
+
+config DVB_B2C2_FLEXCOP_USB
+        tristate "Technisat/B2C2 Air/Sky/Cable2PC USB"
+        depends on DVB_B2C2_FLEXCOP && USB
+        help
+          Support for the Air/Sky/Cable2PC USB1.1 box (DVB/ATSC) by Technisat/B2C2,
+
+          Say Y if you own such a device and want to use it.
+
+config DVB_B2C2_FLEXCOP_DEBUG
+        bool "Enable debug for the B2C2 FlexCop drivers"
+        depends on DVB_B2C2_FLEXCOP
+        help
+          Say Y if you want to enable the module option to control debug messages
+          of all B2C2 FlexCop drivers.
+
+config DVB_B2C2_SKYSTAR
+        tristate "B2C2/Technisat Air/Sky/CableStar 2 PCI"
+        depends on DVB_CORE && PCI
         select DVB_STV0299
         select DVB_MT352
+        select DVB_MT312
+        select DVB_NXT2002
         help
-          Support for the Air/Sky/Cable2PC USB DVB device by B2C2. Currently
-          the does nothing, but providing basic function for the used usb 
-          protocol.
+          Support for the Skystar2 PCI DVB card by Technisat, which
+          is equipped with the FlexCopII chipset by B2C2, and
+          for the B2C2/BBTI Air2PC-ATSC card.
 
           Say Y if you own such a device and want to use it.
-
diff --git a/drivers/media/dvb/b2c2/Makefile b/drivers/media/dvb/b2c2/Makefile
index 9fb1247bfab8..7703812af34f 100644
--- a/drivers/media/dvb/b2c2/Makefile
+++ b/drivers/media/dvb/b2c2/Makefile
@@ -1,6 +1,14 @@
-obj-b2c2-usb = b2c2-usb-core.o b2c2-common.o
+b2c2-flexcop-objs = flexcop.o flexcop-fe-tuner.o flexcop-i2c.o \
+        flexcop-sram.o flexcop-eeprom.o flexcop-misc.o flexcop-hw-filter.o \
+        flexcop-dma.o
+obj-$(CONFIG_DVB_B2C2_FLEXCOP) += b2c2-flexcop.o
+
+b2c2-flexcop-pci-objs = flexcop-pci.o
+obj-$(CONFIG_DVB_B2C2_FLEXCOP_PCI) += b2c2-flexcop-pci.o
+
+b2c2-flexcop-usb-objs = flexcop-usb.o
+obj-$(CONFIG_DVB_B2C2_FLEXCOP_USB) += b2c2-flexcop-usb.o
 
 obj-$(CONFIG_DVB_B2C2_SKYSTAR) += skystar2.o
-obj-$(CONFIG_DVB_B2C2_USB) + = b2c2-usb.o
 
 EXTRA_CFLAGS = -Idrivers/media/dvb/dvb-core/ -Idrivers/media/dvb/frontends/
diff --git a/drivers/media/dvb/b2c2/b2c2-common.c b/drivers/media/dvb/b2c2/b2c2-common.c
deleted file mode 100644
index 000d60c405e3..000000000000
--- a/drivers/media/dvb/b2c2/b2c2-common.c
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * b2c2-common.c - common methods for the B2C2/Technisat SkyStar2 PCI DVB card and
- *                 for the B2C2/Technisat Sky/Cable/AirStar USB devices
- *                 based on the FlexCopII/FlexCopIII by B2C2, Inc.
- *
- * Copyright (C) 2003  Vadim Catana, skystar@moldova.cc
- *
- * FIX: DISEQC Tone Burst in flexcop_diseqc_ioctl()
- * FIX: FULL soft DiSEqC for skystar2 (FlexCopII rev 130) VP310 equipped
- *     Vincenzo Di Massa, hawk.it at tiscalinet.it
- *
- * Converted to Linux coding style
- * Misc reorganization, polishing, restyling
- *     Roberto Ragusa, r.ragusa at libero.it
- *
- * Added hardware filtering support,
- *     Niklas Peinecke, peinecke at gdv.uni-hannover.de
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public License
- * as published by the Free Software Foundation; either version 2.1
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
- *
- */
-#include "stv0299.h"
-#include "mt352.h"
-#include "mt312.h"
-
-static int samsung_tbmu24112_set_symbol_rate(struct dvb_frontend* fe, u32 srate, u32 ratio)
-{
-        u8 aclk = 0;
-        u8 bclk = 0;
-
-        if (srate < 1500000) { aclk = 0xb7; bclk = 0x47; }
-        else if (srate < 3000000) { aclk = 0xb7; bclk = 0x4b; }
-        else if (srate < 7000000) { aclk = 0xb7; bclk = 0x4f; }
-        else if (srate < 14000000) { aclk = 0xb7; bclk = 0x53; }
-        else if (srate < 30000000) { aclk = 0xb6; bclk = 0x53; }
-        else if (srate < 45000000) { aclk = 0xb4; bclk = 0x51; }
-
-        stv0299_writereg (fe, 0x13, aclk);
-        stv0299_writereg (fe, 0x14, bclk);
-        stv0299_writereg (fe, 0x1f, (ratio >> 16) & 0xff);
-        stv0299_writereg (fe, 0x20, (ratio >>  8) & 0xff);
-        stv0299_writereg (fe, 0x21, (ratio      ) & 0xf0);
-
-        return 0;
-}
-
-static int samsung_tbmu24112_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
-{
-        u8 buf[4];
-        u32 div;
-        struct i2c_msg msg = { .addr = 0x61, .flags = 0, .buf = buf, .len = sizeof(buf) };
-//      struct adapter* adapter = (struct adapter*) fe->dvb->priv;
-
-        div = params->frequency / 125;
-
-        buf[0] = (div >> 8) & 0x7f;
-        buf[1] = div & 0xff;
-        buf[2] = 0x84;  // 0xC4
-        buf[3] = 0x08;
-
-        if (params->frequency < 1500000) buf[3] |= 0x10;
-
-//      if (i2c_transfer (&adapter->i2c_adap, &msg, 1) != 1) return -EIO;
-        return 0;
-}
-
-static u8 samsung_tbmu24112_inittab[] = {
-             0x01, 0x15,
-             0x02, 0x30,
-             0x03, 0x00,
-             0x04, 0x7D,
-             0x05, 0x35,
-             0x06, 0x02,
-             0x07, 0x00,
-             0x08, 0xC3,
-             0x0C, 0x00,
-             0x0D, 0x81,
-             0x0E, 0x23,
-             0x0F, 0x12,
-             0x10, 0x7E,
-             0x11, 0x84,
-             0x12, 0xB9,
-             0x13, 0x88,
-             0x14, 0x89,
-             0x15, 0xC9,
-             0x16, 0x00,
-             0x17, 0x5C,
-             0x18, 0x00,
-             0x19, 0x00,
-             0x1A, 0x00,
-             0x1C, 0x00,
-             0x1D, 0x00,
-             0x1E, 0x00,
-             0x1F, 0x3A,
-             0x20, 0x2E,
-             0x21, 0x80,
-             0x22, 0xFF,
-             0x23, 0xC1,
-             0x28, 0x00,
-             0x29, 0x1E,
-             0x2A, 0x14,
-             0x2B, 0x0F,
-             0x2C, 0x09,
-             0x2D, 0x05,
-             0x31, 0x1F,
-             0x32, 0x19,
-             0x33, 0xFE,
-             0x34, 0x93,
-             0xff, 0xff,
-};
-
-static struct stv0299_config samsung_tbmu24112_config = {
-        .demod_address = 0x68,
-        .inittab = samsung_tbmu24112_inittab,
-        .mclk = 88000000UL,
-        .invert = 0,
-        .enhanced_tuning = 0,
-        .skip_reinit = 0,
-        .lock_output = STV0229_LOCKOUTPUT_LK,
-        .volt13_op0_op1 = STV0299_VOLT13_OP1,
-        .min_delay_ms = 100,
-        .set_symbol_rate = samsung_tbmu24112_set_symbol_rate,
-        .pll_set = samsung_tbmu24112_pll_set,
-};
-
-
-
-
-
-static int samsung_tdtc9251dh0_demod_init(struct dvb_frontend* fe)
-{
-        static u8 mt352_clock_config [] = { 0x89, 0x10, 0x2d };
-        static u8 mt352_reset [] = { 0x50, 0x80 };
-        static u8 mt352_adc_ctl_1_cfg [] = { 0x8E, 0x40 };
-        static u8 mt352_agc_cfg [] = { 0x67, 0x28, 0xa1 };
-        static u8 mt352_capt_range_cfg[] = { 0x75, 0x32 };
-
-        mt352_write(fe, mt352_clock_config, sizeof(mt352_clock_config));
-        udelay(2000);
-        mt352_write(fe, mt352_reset, sizeof(mt352_reset));
-        mt352_write(fe, mt352_adc_ctl_1_cfg, sizeof(mt352_adc_ctl_1_cfg));
-
-        mt352_write(fe, mt352_agc_cfg, sizeof(mt352_agc_cfg));
-        mt352_write(fe, mt352_capt_range_cfg, sizeof(mt352_capt_range_cfg));
-
-        return 0;
-}
-
-static int samsung_tdtc9251dh0_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params, u8* pllbuf)
-{
-        u32 div;
-        unsigned char bs = 0;
-
-        #define IF_FREQUENCYx6 217    /* 6 * 36.16666666667MHz */
-        div = (((params->frequency + 83333) * 3) / 500000) + IF_FREQUENCYx6;
-
-        if (params->frequency >= 48000000 && params->frequency <= 154000000) bs = 0x09;
-        if (params->frequency >= 161000000 && params->frequency <= 439000000) bs = 0x0a;
-        if (params->frequency >= 447000000 && params->frequency <= 863000000) bs = 0x08;
-
-        pllbuf[0] = 0xc2; // Note: non-linux standard PLL i2c address
-        pllbuf[1] = div >> 8;
-        pllbuf[2] = div & 0xff;
-        pllbuf[3] = 0xcc;
-        pllbuf[4] = bs;
-
-        return 0;
-}
-
-static struct mt352_config samsung_tdtc9251dh0_config = {
-
-        .demod_address = 0x0f,
-        .demod_init = samsung_tdtc9251dh0_demod_init,
-        .pll_set = samsung_tdtc9251dh0_pll_set,
-};
-
-static int skystar23_samsung_tbdu18132_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
-{
-        u8 buf[4];
-        u32 div;
-        struct i2c_msg msg = { .addr = 0x61, .flags = 0, .buf = buf, .len = sizeof(buf) };
-//      struct adapter* adapter = (struct adapter*) fe->dvb->priv;
-
-        div = (params->frequency + (125/2)) / 125;
-
-        buf[0] = (div >> 8) & 0x7f;
-        buf[1] = (div >> 0) & 0xff;
-        buf[2] = 0x84 | ((div >> 10) & 0x60);
-        buf[3] = 0x80;
-
-        if (params->frequency < 1550000)
-                buf[3] |= 0x02;
-
-        //if (i2c_transfer (&adapter->i2c_adap, &msg, 1) != 1) return -EIO;
-        return 0;
-}
-
-static struct mt312_config skystar23_samsung_tbdu18132_config = {
-
-        .demod_address = 0x0e,
-        .pll_set = skystar23_samsung_tbdu18132_pll_set,
-};
diff --git a/drivers/media/dvb/b2c2/b2c2-usb-core.c b/drivers/media/dvb/b2c2/b2c2-usb-core.c
deleted file mode 100644
index 9306da046c91..000000000000
--- a/drivers/media/dvb/b2c2/b2c2-usb-core.c
+++ /dev/null
@@ -1,549 +0,0 @@
-/*
- * Copyright (C) 2004 Patrick Boettcher <patrick.boettcher@desy.de>,
- *                    Luca Bertagnolio <>,
- *
- * based on information provided by John Jurrius from BBTI, Inc.
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License as
- *      published by the Free Software Foundation, version 2.
- *
- */
-
-#include <linux/config.h>
-#include <linux/kernel.h>
-#include <linux/usb.h>
-#include <linux/moduleparam.h>
-#include <linux/pci.h>
-#include <linux/version.h>
-
-#include "dmxdev.h"
-#include "dvb_demux.h"
-#include "dvb_filter.h"
-#include "dvb_net.h"
-#include "dvb_frontend.h"
-
-/* debug */
-#define dprintk(level,args...) \
-            do { if ((debug & level)) { printk(args); } } while (0)
-#define debug_dump(b,l) if (debug) {\
-        int i; deb_xfer("%s: %d > ",__FUNCTION__,l); \
-        for (i = 0; i < l; i++) deb_xfer("%02x ", b[i]); \
-        deb_xfer("\n");\
-}
-
-static int debug;
-module_param(debug, int, 0644);
-MODULE_PARM_DESC(debug, "set debugging level (1=info,ts=2,ctrl=4 (or-able)).");
-
-#define deb_info(args...) dprintk(0x01,args)
-#define deb_ts(args...)   dprintk(0x02,args)
-#define deb_ctrl(args...) dprintk(0x04,args)
-
-/* Version information */
-#define DRIVER_VERSION "0.0"
-#define DRIVER_DESC "Driver for B2C2/Technisat Air/Cable/Sky-2-PC USB devices"
-#define DRIVER_AUTHOR "Patrick Boettcher, patrick.boettcher@desy.de"
-
-/* transfer parameters */
-#define B2C2_USB_FRAMES_PER_ISO         4
-#define B2C2_USB_NUM_ISO_URB            4    /* TODO check out a good value */
-
-#define B2C2_USB_CTRL_PIPE_IN           usb_rcvctrlpipe(b2c2->udev,0)
-#define B2C2_USB_CTRL_PIPE_OUT          usb_sndctrlpipe(b2c2->udev,0)
-#define B2C2_USB_DATA_PIPE                      usb_rcvisocpipe(b2c2->udev,0x81)
-
-struct usb_b2c2_usb {
-        struct usb_device *udev;
-        struct usb_interface *uintf;
-
-        u8 *iso_buffer;
-        int buffer_size;
-        dma_addr_t iso_dma_handle;
-        struct urb *iso_urb[B2C2_USB_NUM_ISO_URB];
-};
-
-
-/*
- * USB
- * 10 90 34 12 78 56 04 00
- * usb_control_msg(udev, usb_sndctrlpipe(udev,0),
- * 0x90,
- * 0x10,
- * 0x1234,
- * 0x5678,
- * buf,
- * 4,
- * 5*HZ);
- *
- * extern int usb_control_msg(struct usb_device *dev, unsigned int pipe,
- * __u8 request,
- * __u8 requesttype,
- * __u16 value,
- * __u16 index,
- * void *data,
- * __u16 size,
- * int timeout);
- *
- */
-
-/* request types */
-typedef enum {
-
-/* something is wrong with this part
-        RTYPE_READ_DW         = (1 << 6),
-        RTYPE_WRITE_DW_1      = (3 << 6),
-        RTYPE_READ_V8_MEMORY  = (6 << 6),
-        RTYPE_WRITE_V8_MEMORY = (7 << 6),
-        RTYPE_WRITE_V8_FLASH  = (8 << 6),
-        RTYPE_GENERIC         = (9 << 6),
-*/
-        RTYPE_READ_DW = (3 << 6),
-        RTYPE_WRITE_DW_1 = (1 << 6),
-        
-        RTYPE_READ_V8_MEMORY  = (6 << 6),
-        RTYPE_WRITE_V8_MEMORY = (7 << 6),
-        RTYPE_WRITE_V8_FLASH  = (8 << 6),
-        RTYPE_GENERIC         = (9 << 6),
-} b2c2_usb_request_type_t;
-
-/* request */
-typedef enum {
-        B2C2_USB_WRITE_V8_MEM = 0x04,
-        B2C2_USB_READ_V8_MEM  = 0x05,
-        B2C2_USB_READ_REG     = 0x08,
-        B2C2_USB_WRITE_REG    = 0x0A,
-/*      B2C2_USB_WRITEREGLO   = 0x0A, */
-        B2C2_USB_WRITEREGHI   = 0x0B,
-        B2C2_USB_FLASH_BLOCK  = 0x10,
-        B2C2_USB_I2C_REQUEST  = 0x11,
-        B2C2_USB_UTILITY      = 0x12,
-} b2c2_usb_request_t;
-
-/* function definition for I2C_REQUEST */
-typedef enum {
-        USB_FUNC_I2C_WRITE       = 0x01,
-        USB_FUNC_I2C_MULTIWRITE  = 0x02,
-        USB_FUNC_I2C_READ        = 0x03,
-        USB_FUNC_I2C_REPEATWRITE = 0x04,
-        USB_FUNC_GET_DESCRIPTOR  = 0x05,
-        USB_FUNC_I2C_REPEATREAD  = 0x06,
-/* DKT 020208 - add this to support special case of DiSEqC */
-        USB_FUNC_I2C_CHECKWRITE  = 0x07,
-        USB_FUNC_I2C_CHECKRESULT = 0x08,
-} b2c2_usb_i2c_function_t;
-
-/*
- * function definition for UTILITY request 0x12
- * DKT 020304 - new utility function
- */
-typedef enum {
-        UTILITY_SET_FILTER          = 0x01,
-        UTILITY_DATA_ENABLE         = 0x02,
-        UTILITY_FLEX_MULTIWRITE     = 0x03,
-        UTILITY_SET_BUFFER_SIZE     = 0x04,
-        UTILITY_FLEX_OPERATOR       = 0x05,
-        UTILITY_FLEX_RESET300_START = 0x06,
-        UTILITY_FLEX_RESET300_STOP  = 0x07,
-        UTILITY_FLEX_RESET300       = 0x08,
-        UTILITY_SET_ISO_SIZE        = 0x09,
-        UTILITY_DATA_RESET          = 0x0A,
-        UTILITY_GET_DATA_STATUS     = 0x10,
-        UTILITY_GET_V8_REG          = 0x11,
-/* DKT 020326 - add function for v1.14 */
-        UTILITY_SRAM_WRITE          = 0x12,
-        UTILITY_SRAM_READ           = 0x13,
-        UTILITY_SRAM_TESTFILL       = 0x14,
-        UTILITY_SRAM_TESTSET        = 0x15,
-        UTILITY_SRAM_TESTVERIFY     = 0x16,
-} b2c2_usb_utility_function_t;
-
-#define B2C2_WAIT_FOR_OPERATION_RW  1  // 1 s
-#define B2C2_WAIT_FOR_OPERATION_RDW 3  // 3 s
-#define B2C2_WAIT_FOR_OPERATION_WDW 1  // 1 s
-
-#define B2C2_WAIT_FOR_OPERATION_V8READ   3  // 3 s
-#define B2C2_WAIT_FOR_OPERATION_V8WRITE  3  // 3 s
-#define B2C2_WAIT_FOR_OPERATION_V8FLASH  3  // 3 s
-
-/* JLP 111700: we will include the 1 bit gap between the upper and lower 3 bits
- * in the IBI address, to make the V8 code simpler.
- * PCI ADDRESS FORMAT: 0x71C -> 0000 0111 0001 1100 (these are the six bits used)
- *                  in general: 0000 0HHH 000L LL00
- * IBI ADDRESS FORMAT:                    RHHH BLLL
- *
- * where R is the read(1)/write(0) bit, B is the busy bit
- * and HHH and LLL are the two sets of three bits from the PCI address.
- */
-#define B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(usPCI) (u8) (((usPCI >> 2) & 0x07) + ((usPCI >> 4) & 0x70))
-#define B2C2_FLEX_INTERNALADDR_TO_PCIOFFSET(ucAddr) (u16) (((ucAddr & 0x07) << 2) + ((ucAddr & 0x70) << 4))
-
-/*
- * DKT 020228 - forget about this VENDOR_BUFFER_SIZE, read and write register
- * deal with DWORD or 4 bytes, that should be should from now on
- */
-static u32 b2c2_usb_read_dw(struct usb_b2c2_usb *b2c2, u16 wRegOffsPCI)
-{
-        u32 val;
-        u16 wAddress = B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(wRegOffsPCI) | 0x0080;
-        int len = usb_control_msg(b2c2->udev,
-                        B2C2_USB_CTRL_PIPE_IN,
-                        B2C2_USB_READ_REG,
-                        RTYPE_READ_DW,
-                        wAddress,
-                        0,
-                        &val,
-                        sizeof(u32),
-                        B2C2_WAIT_FOR_OPERATION_RDW * 1000);
-
-        if (len != sizeof(u32)) {
-                err("error while reading dword from %d (%d).",wAddress,wRegOffsPCI);
-                return -EIO;
-        } else
-                return val;
-}
-
-/*
- * DKT 020228 - from now on, we don't support anything older than firm 1.00
- * I eliminated the write register as a 2 trip of writing hi word and lo word
- * and force this to write only 4 bytes at a time.
- * NOTE: this should work with all the firmware from 1.00 and newer
- */
-static int b2c2_usb_write_dw(struct usb_b2c2_usb *b2c2, u16 wRegOffsPCI, u32 val)
-{
-        u16 wAddress = B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(wRegOffsPCI);
-        int len = usb_control_msg(b2c2->udev,
-                        B2C2_USB_CTRL_PIPE_OUT,
-                        B2C2_USB_WRITE_REG,
-                        RTYPE_WRITE_DW_1,
-                        wAddress,
-                        0,
-                        &val,
-                        sizeof(u32),
-                        B2C2_WAIT_FOR_OPERATION_RDW * 1000);
-
-        if (len != sizeof(u32)) {
-                err("error while reading dword from %d (%d).",wAddress,wRegOffsPCI);
-                return -EIO;
-        } else
-                return 0;
-}
-
-/*
- * DKT 010817 - add support for V8 memory read/write and flash update
- */
-static int b2c2_usb_v8_memory_req(struct usb_b2c2_usb *b2c2,
-                b2c2_usb_request_t req, u8 page, u16 wAddress,
-                u16 buflen, u8 *pbBuffer)
-{
-        u8 dwRequestType;
-        u16 wIndex;
-        int nWaitTime,pipe,len;
-
-        wIndex = page << 8;
-
-        switch (req) {
-                case B2C2_USB_READ_V8_MEM:
-                        nWaitTime = B2C2_WAIT_FOR_OPERATION_V8READ;
-                        dwRequestType = (u8) RTYPE_READ_V8_MEMORY;
-                        pipe = B2C2_USB_CTRL_PIPE_IN;
-                break;
-                case B2C2_USB_WRITE_V8_MEM:
-                        wIndex |= pbBuffer[0];
-                        nWaitTime = B2C2_WAIT_FOR_OPERATION_V8WRITE;
-                        dwRequestType = (u8) RTYPE_WRITE_V8_MEMORY;
-                        pipe = B2C2_USB_CTRL_PIPE_OUT;
-                break;
-                case B2C2_USB_FLASH_BLOCK:
-                        nWaitTime = B2C2_WAIT_FOR_OPERATION_V8FLASH;
-                        dwRequestType = (u8) RTYPE_WRITE_V8_FLASH;
-                        pipe = B2C2_USB_CTRL_PIPE_OUT;
-                break;
-                default:
-                        deb_info("unsupported request for v8_mem_req %x.\n",req);
-                return -EINVAL;
-        }
-        len = usb_control_msg(b2c2->udev,pipe,
-                        req,
-                        dwRequestType,
-                        wAddress,
-                        wIndex,
-                        pbBuffer,
-                        buflen,
-                        nWaitTime * 1000);
-        return len == buflen ? 0 : -EIO;
-}
-
-static int b2c2_usb_i2c_req(struct usb_b2c2_usb *b2c2,
-                b2c2_usb_request_t req, b2c2_usb_i2c_function_t func,
-                u8 port, u8 chipaddr, u8 addr, u8 buflen, u8 *buf)
-{
-        u16 wValue, wIndex;
-        int nWaitTime,pipe,len;
-        u8 dwRequestType;
-
-        switch (func) {
-                case USB_FUNC_I2C_WRITE:
-                case USB_FUNC_I2C_MULTIWRITE:
-                case USB_FUNC_I2C_REPEATWRITE:
-                /* DKT 020208 - add this to support special case of DiSEqC */
-                case USB_FUNC_I2C_CHECKWRITE:
-                        pipe = B2C2_USB_CTRL_PIPE_OUT;
-                        nWaitTime = 2;
-                        dwRequestType = (u8) RTYPE_GENERIC;
-                break;
-                case USB_FUNC_I2C_READ:
-                case USB_FUNC_I2C_REPEATREAD:
-                        pipe = B2C2_USB_CTRL_PIPE_IN;
-                        nWaitTime = 2;
-                        dwRequestType = (u8) RTYPE_GENERIC;
-                break;
-                default:
-                        deb_info("unsupported function for i2c_req %x\n",func);
-                        return -EINVAL;
-        }
-        wValue = (func << 8 ) | port;
-        wIndex = (chipaddr << 8 ) | addr;
-
-        len = usb_control_msg(b2c2->udev,pipe,
-                        req,
-                        dwRequestType,
-                        addr,
-                        wIndex,
-                        buf,
-                        buflen,
-                        nWaitTime * 1000);
-        return len == buflen ? 0 : -EIO;
-}
-
-int static b2c2_usb_utility_req(struct usb_b2c2_usb *b2c2, int set,
-                b2c2_usb_utility_function_t func, u8 extra, u16 wIndex,
-                u16 buflen, u8 *pvBuffer)
-{
-        u16 wValue;
-        int nWaitTime = 2,
-                pipe = set ? B2C2_USB_CTRL_PIPE_OUT : B2C2_USB_CTRL_PIPE_IN,
-                len;
-
-        wValue = (func << 8) | extra;
-
-        len = usb_control_msg(b2c2->udev,pipe,
-                        B2C2_USB_UTILITY,
-                        (u8) RTYPE_GENERIC,
-                        wValue,
-                        wIndex,
-                        pvBuffer,
-                        buflen,
-                        nWaitTime * 1000);
-        return len == buflen ? 0 : -EIO;
-}
-
-
-
-static void b2c2_dumpfourreg(struct usb_b2c2_usb *b2c2, u16 offs)
-{
-        u32 r0,r1,r2,r3;
-        r0 = r1 = r2 = r3 = 0;
-        r0 = b2c2_usb_read_dw(b2c2,offs);
-        r1 = b2c2_usb_read_dw(b2c2,offs + 0x04);
-        r2 = b2c2_usb_read_dw(b2c2,offs + 0x08);
-        r3 = b2c2_usb_read_dw(b2c2,offs + 0x0c);
-        deb_ctrl("dump: offset: %03x, %08x, %08x, %08x, %08x\n",offs,r0,r1,r2,r3);
-}
-
-static void b2c2_urb_complete(struct urb *urb, struct pt_regs *ptregs)
-{
-        struct usb_b2c2_usb *b2c2 = urb->context;
-        deb_ts("urb completed, bufsize: %d\n",urb->transfer_buffer_length);
-
-//      urb_submit_urb(urb,GFP_ATOMIC); enable for real action
-}
-
-static void b2c2_exit_usb(struct usb_b2c2_usb *b2c2)
-{
-        int i;
-        for (i = 0; i < B2C2_USB_NUM_ISO_URB; i++)
-                if (b2c2->iso_urb[i] != NULL) { /* not sure about unlink_urb and iso-urbs TODO */
-                        deb_info("unlinking/killing urb no. %d\n",i);
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,7)
-                        usb_unlink_urb(b2c2->iso_urb[i]);
-#else
-                        usb_kill_urb(b2c2->iso_urb[i]);
-#endif
-                        usb_free_urb(b2c2->iso_urb[i]);
-                }
-
-        if (b2c2->iso_buffer != NULL)
-                pci_free_consistent(NULL,b2c2->buffer_size, b2c2->iso_buffer, b2c2->iso_dma_handle);
-
-}
-
-static int b2c2_init_usb(struct usb_b2c2_usb *b2c2)
-{
-        u16 frame_size = le16_to_cpu(b2c2->uintf->cur_altsetting->endpoint[0].desc.wMaxPacketSize);
-        int bufsize = B2C2_USB_NUM_ISO_URB * B2C2_USB_FRAMES_PER_ISO * frame_size,i,j,ret;
-        int buffer_offset = 0;
-
-        deb_info("creating %d iso-urbs with %d frames each of %d bytes size = %d.\n",
-                        B2C2_USB_NUM_ISO_URB, B2C2_USB_FRAMES_PER_ISO, frame_size,bufsize);
-
-        b2c2->iso_buffer = pci_alloc_consistent(NULL,bufsize,&b2c2->iso_dma_handle);
-        if (b2c2->iso_buffer == NULL)
-                return -ENOMEM;
-        memset(b2c2->iso_buffer, 0, bufsize);
-        b2c2->buffer_size = bufsize;
-
-        /* creating iso urbs */
-        for (i = 0; i < B2C2_USB_NUM_ISO_URB; i++)
-                if (!(b2c2->iso_urb[i] = usb_alloc_urb(B2C2_USB_FRAMES_PER_ISO,GFP_ATOMIC))) {
-                        ret = -ENOMEM;
-                        goto urb_error;
-                }
-        /* initialising and submitting iso urbs */
-        for (i = 0; i < B2C2_USB_NUM_ISO_URB; i++) {
-                int frame_offset = 0;
-                struct urb *urb = b2c2->iso_urb[i];
-                deb_info("initializing and submitting urb no. %d (buf_offset: %d).\n",i,buffer_offset);
-
-                urb->dev = b2c2->udev;
-                urb->context = b2c2;
-                urb->complete = b2c2_urb_complete;
-                urb->pipe = B2C2_USB_DATA_PIPE;
-                urb->transfer_flags = URB_ISO_ASAP;
-                urb->interval = 1;
-                urb->number_of_packets = B2C2_USB_FRAMES_PER_ISO;
-                urb->transfer_buffer_length = frame_size * B2C2_USB_FRAMES_PER_ISO;
-                urb->transfer_buffer = b2c2->iso_buffer + buffer_offset;
-
-                buffer_offset += frame_size * B2C2_USB_FRAMES_PER_ISO;
-                for (j = 0; j < B2C2_USB_FRAMES_PER_ISO; j++) {
-                        deb_info("urb no: %d, frame: %d, frame_offset: %d\n",i,j,frame_offset);
-                        urb->iso_frame_desc[j].offset = frame_offset;
-                        urb->iso_frame_desc[j].length = frame_size;
-                        frame_offset += frame_size;
-                }
-
-                if ((ret = usb_submit_urb(b2c2->iso_urb[i],GFP_ATOMIC))) {
-                        err("submitting urb %d failed with %d.",i,ret);
-                        goto urb_error;
-                }
-                deb_info("submitted urb no. %d.\n",i);
-        }
-
-        ret = 0;
-        goto success;
-urb_error:
-        b2c2_exit_usb(b2c2);
-success:
-        return ret;
-}
-
-static int b2c2_usb_probe(struct usb_interface *intf,
-                const struct usb_device_id *id)
-{
-        struct usb_device *udev = interface_to_usbdev(intf);
-        struct usb_b2c2_usb *b2c2 = NULL;
-        int ret;
-
-        b2c2 = kmalloc(sizeof(struct usb_b2c2_usb),GFP_KERNEL);
-        if (b2c2 == NULL) {
-                err("no memory");
-                return -ENOMEM;
-        }
-        b2c2->udev = udev;
-        b2c2->uintf = intf;
-
-        /* use the alternate setting with the larges buffer */
-        usb_set_interface(udev,0,1);
-
-        if ((ret = b2c2_init_usb(b2c2)))
-                goto usb_init_error;
-
-        usb_set_intfdata(intf,b2c2);
-
-        switch (udev->speed) {
-                case USB_SPEED_LOW:
-                        err("cannot handle USB speed because it is to sLOW.");
-                        break;
-                case USB_SPEED_FULL:
-                        info("running at FULL speed.");
-                        break;
-                case USB_SPEED_HIGH:
-                        info("running at HIGH speed.");
-                        break;
-                case USB_SPEED_UNKNOWN: /* fall through */
-                default:
-                        err("cannot handle USB speed because it is unkown.");
-                break;
-        }
-
-        b2c2_dumpfourreg(b2c2,0x200);
-        b2c2_dumpfourreg(b2c2,0x300);
-        b2c2_dumpfourreg(b2c2,0x400);
-        b2c2_dumpfourreg(b2c2,0x700);
-
-
-        if (ret == 0)
-                info("%s successfully initialized and connected.",DRIVER_DESC);
-        else
-                info("%s error while loading driver (%d)",DRIVER_DESC,ret);
-
-        ret = 0;
-        goto success;
-
-usb_init_error:
-        kfree(b2c2);
-success:
-        return ret;
-}
-
-static void b2c2_usb_disconnect(struct usb_interface *intf)
-{
-        struct usb_b2c2_usb *b2c2 = usb_get_intfdata(intf);
-        usb_set_intfdata(intf,NULL);
-        if (b2c2 != NULL) {
-                b2c2_exit_usb(b2c2);
-                kfree(b2c2);
-        }
-        info("%s successfully deinitialized and disconnected.",DRIVER_DESC);
-
-}
-
-static struct usb_device_id b2c2_usb_table [] = {
-            { USB_DEVICE(0x0af7, 0x0101) }
-};
-
-/* usb specific object needed to register this driver with the usb subsystem */
-static struct usb_driver b2c2_usb_driver = {
-        .owner          = THIS_MODULE,
-        .name           = "dvb_b2c2_usb",
-        .probe          = b2c2_usb_probe,
-        .disconnect = b2c2_usb_disconnect,
-        .id_table       = b2c2_usb_table,
-};
-
-/* module stuff */
-static int __init b2c2_usb_init(void)
-{
-        int result;
-        if ((result = usb_register(&b2c2_usb_driver))) {
-                err("usb_register failed. Error number %d",result);
-                return result;
-        }
-
-        return 0;
-}
-
-static void __exit b2c2_usb_exit(void)
-{
-        /* deregister this driver from the USB subsystem */
-        usb_deregister(&b2c2_usb_driver);
-}
-
-module_init (b2c2_usb_init);
-module_exit (b2c2_usb_exit);
-
-MODULE_AUTHOR(DRIVER_AUTHOR);
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_LICENSE("GPL");
-MODULE_DEVICE_TABLE(usb, b2c2_usb_table);
diff --git a/drivers/media/dvb/b2c2/flexcop-common.h b/drivers/media/dvb/b2c2/flexcop-common.h
new file mode 100644
index 000000000000..773d158032df
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-common.h
@@ -0,0 +1,164 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-common.h - common header file for device-specific source files also.
+ *
+ * see flexcop.c for copyright information.
+ */
+#ifndef __FLEXCOP_COMMON_H__
+#define __FLEXCOP_COMMON_H__
+
+#include <linux/config.h>
+#include <linux/pci.h>
+
+#include "flexcop-reg.h"
+
+#include "dmxdev.h"
+#include "dvb_demux.h"
+#include "dvb_filter.h"
+#include "dvb_net.h"
+#include "dvb_frontend.h"
+
+#define FC_MAX_FEED 256
+
+#ifndef FC_LOG_PREFIX
+#warning please define a log prefix for your file, using a default one
+#define FC_LOG_PREFIX "b2c2-undef"
+#endif
+
+/* Steal from usb.h */
+#undef err
+#define err(format,  arg...) printk(KERN_ERR     FC_LOG_PREFIX ": " format "\n" , ## arg)
+#undef info
+#define info(format, arg...) printk(KERN_INFO    FC_LOG_PREFIX ": " format "\n" , ## arg)
+#undef warn
+#define warn(format, arg...) printk(KERN_WARNING FC_LOG_PREFIX ": " format "\n" , ## arg)
+
+struct flexcop_dma {
+        struct pci_dev *pdev;
+
+        u8 *cpu_addr0;
+        dma_addr_t dma_addr0;
+        u8 *cpu_addr1;
+        dma_addr_t dma_addr1;
+        u32 size; /* size of each address in bytes */
+};
+
+/* Control structure for data definitions that are common to
+ * the B2C2-based PCI and USB devices.
+ */
+struct flexcop_device {
+        /* general */
+        struct device *dev; /* for firmware_class */
+
+#define FC_STATE_DVB_INIT 0x01
+#define FC_STATE_I2C_INIT 0x02
+#define FC_STATE_FE_INIT  0x04
+        int init_state;
+
+        /* device information */
+        int has_32_hw_pid_filter;
+        flexcop_revision_t rev;
+        flexcop_device_type_t dev_type;
+        flexcop_bus_t bus_type;
+
+        /* dvb stuff */
+        struct dvb_adapter dvb_adapter;
+        struct dvb_frontend *fe;
+        struct dvb_net dvbnet;
+        struct dvb_demux demux;
+        struct dmxdev dmxdev;
+        struct dmx_frontend hw_frontend;
+        struct dmx_frontend mem_frontend;
+        int (*fe_sleep) (struct dvb_frontend *);
+
+        struct i2c_adapter i2c_adap;
+        struct semaphore i2c_sem;
+
+        struct module *owner;
+
+        /* options and status */
+        int extra_feedcount;
+        int feedcount;
+        int pid_filtering;
+        int fullts_streaming_state;
+
+        /* bus specific callbacks */
+        flexcop_ibi_value (*read_ibi_reg)  (struct flexcop_device *, flexcop_ibi_register);
+        int               (*write_ibi_reg) (struct flexcop_device *, flexcop_ibi_register, flexcop_ibi_value);
+
+
+        int (*i2c_request) (struct flexcop_device*, flexcop_access_op_t, flexcop_i2c_port_t, u8 chipaddr, u8 addr, u8 *buf, u16 len);
+        int (*stream_control) (struct flexcop_device*, int);
+
+        int (*get_mac_addr) (struct flexcop_device *fc, int extended);
+
+        void *bus_specific;
+};
+
+/* exported prototypes */
+
+/* from flexcop.c */
+void flexcop_pass_dmx_data(struct flexcop_device *fc, u8 *buf, u32 len);
+void flexcop_pass_dmx_packets(struct flexcop_device *fc, u8 *buf, u32 no);
+
+struct flexcop_device *flexcop_device_kmalloc(size_t bus_specific_len);
+void flexcop_device_kfree(struct flexcop_device*);
+
+int  flexcop_device_initialize(struct flexcop_device*);
+void flexcop_device_exit(struct flexcop_device *fc);
+
+/* from flexcop-dma.c */
+int flexcop_dma_allocate(struct pci_dev *pdev, struct flexcop_dma *dma, u32 size);
+void flexcop_dma_free(struct flexcop_dma *dma);
+
+int flexcop_dma_control_timer_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff);
+int flexcop_dma_control_size_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff);
+int flexcop_dma_control_packet_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff);
+int flexcop_dma_config(struct flexcop_device *fc, struct flexcop_dma *dma, flexcop_dma_index_t dma_idx,flexcop_dma_addr_index_t index);
+int flexcop_dma_config_timer(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, u8 cycles);
+int flexcop_dma_config_packet_count(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, u8 packets);
+
+/* from flexcop-eeprom.c */
+/* the PCI part uses this call to get the MAC address, the USB part has its own */
+int flexcop_eeprom_check_mac_addr(struct flexcop_device *fc, int extended);
+
+/* from flexcop-i2c.c */
+/* the PCI part uses this a i2c_request callback, whereas the usb part has its own
+ * one. We have it in flexcop-i2c.c, because it is going via the actual
+ * I2C-channel of the flexcop.
+ */
+int flexcop_i2c_request(struct flexcop_device*, flexcop_access_op_t,
+                        flexcop_i2c_port_t, u8 chipaddr, u8 addr, u8 *buf, u16 len);
+
+/* from flexcop-sram.c */
+int flexcop_sram_set_dest(struct flexcop_device *fc, flexcop_sram_dest_t dest, flexcop_sram_dest_target_t target);
+void flexcop_wan_set_speed(struct flexcop_device *fc, flexcop_wan_speed_t s);
+void flexcop_sram_ctrl(struct flexcop_device *fc, int usb_wan, int sramdma, int maximumfill);
+
+/* global prototypes for the flexcop-chip */
+/* from flexcop-fe-tuner.c */
+int flexcop_frontend_init(struct flexcop_device *card);
+void flexcop_frontend_exit(struct flexcop_device *fc);
+
+/* from flexcop-i2c.c */
+int flexcop_i2c_init(struct flexcop_device *fc);
+void flexcop_i2c_exit(struct flexcop_device *fc);
+
+/* from flexcop-sram.c */
+int flexcop_sram_init(struct flexcop_device *fc);
+
+/* from flexcop-misc.c */
+void flexcop_determine_revision(struct flexcop_device *fc);
+void flexcop_device_name(struct flexcop_device *fc,const char *prefix,const char *suffix);
+
+/* from flexcop-hw-filter.c */
+int flexcop_pid_feed_control(struct flexcop_device *fc, struct dvb_demux_feed *dvbdmxfeed, int onoff);
+void flexcop_hw_filter_init(struct flexcop_device *fc);
+
+void flexcop_smc_ctrl(struct flexcop_device *fc, int onoff);
+
+void flexcop_set_mac_filter(struct flexcop_device *fc, u8 mac[6]);
+void flexcop_mac_filter_ctrl(struct flexcop_device *fc, int onoff);
+
+#endif
diff --git a/drivers/media/dvb/b2c2/flexcop-dma.c b/drivers/media/dvb/b2c2/flexcop-dma.c
new file mode 100644
index 000000000000..8d2706075360
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-dma.c
@@ -0,0 +1,149 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-dma.c - methods for configuring and controlling the DMA of the FlexCop.
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+int flexcop_dma_allocate(struct pci_dev *pdev, struct flexcop_dma *dma, u32 size)
+{
+        u8 *tcpu;
+        dma_addr_t tdma;
+
+        if (size % 2) {
+                err("dma buffersize has to be even.");
+                return -EINVAL;
+        }
+
+        if ((tcpu = pci_alloc_consistent(pdev, size, &tdma)) != NULL) {
+                dma->pdev = pdev;
+                dma->cpu_addr0 = tcpu;
+                dma->dma_addr0 = tdma;
+                dma->cpu_addr1 = tcpu + size/2;
+                dma->dma_addr1 = tdma + size/2;
+                dma->size = size/2;
+                return 0;
+        }
+        return -ENOMEM;
+}
+EXPORT_SYMBOL(flexcop_dma_allocate);
+
+void flexcop_dma_free(struct flexcop_dma *dma)
+{
+        pci_free_consistent(dma->pdev, dma->size*2,dma->cpu_addr0, dma->dma_addr0);
+        memset(dma,0,sizeof(struct flexcop_dma));
+}
+EXPORT_SYMBOL(flexcop_dma_free);
+
+int flexcop_dma_control_timer_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff)
+{
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,ctrl_208);
+
+        if (no & FC_DMA_1)
+                v.ctrl_208.DMA1_Timer_Enable_sig = onoff;
+
+        if (no & FC_DMA_2)
+                v.ctrl_208.DMA2_Timer_Enable_sig = onoff;
+
+        fc->write_ibi_reg(fc,ctrl_208,v);
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_dma_control_timer_irq);
+
+int flexcop_dma_control_size_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff)
+{
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,ctrl_208);
+
+        if (no & FC_DMA_1)
+                v.ctrl_208.DMA1_IRQ_Enable_sig = onoff;
+
+        if (no & FC_DMA_2)
+                v.ctrl_208.DMA2_IRQ_Enable_sig = onoff;
+
+        fc->write_ibi_reg(fc,ctrl_208,v);
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_dma_control_size_irq);
+
+int flexcop_dma_control_packet_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff)
+{
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,ctrl_208);
+
+        if (no & FC_DMA_1)
+                v.ctrl_208.DMA1_Size_IRQ_Enable_sig = onoff;
+
+        if (no & FC_DMA_2)
+                v.ctrl_208.DMA2_Size_IRQ_Enable_sig = onoff;
+
+        fc->write_ibi_reg(fc,ctrl_208,v);
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_dma_control_packet_irq);
+
+int flexcop_dma_config(struct flexcop_device *fc, struct flexcop_dma *dma, flexcop_dma_index_t dma_idx,flexcop_dma_addr_index_t index)
+{
+
+        flexcop_ibi_value v0x0,v0x4,v0xc;
+        v0x0.raw = v0x4.raw = v0xc.raw = 0;
+
+        v0x0.dma_0x0.dma_address0        = dma->dma_addr0 >> 2;
+        v0xc.dma_0xc.dma_address1        = dma->dma_addr1 >> 2;
+        v0x4.dma_0x4_write.dma_addr_size = dma->size / 4;
+
+        if (index & FC_DMA_SUBADDR_0)
+                v0x0.dma_0x0.dma_0start = 1;
+
+        if (index & FC_DMA_SUBADDR_1)
+                v0xc.dma_0xc.dma_1start = 1;
+
+        if (dma_idx & FC_DMA_1) {
+                fc->write_ibi_reg(fc,dma1_000,v0x0);
+                fc->write_ibi_reg(fc,dma1_004,v0x4);
+                fc->write_ibi_reg(fc,dma1_00c,v0xc);
+        } else { /* (dma_idx & FC_DMA_2) */
+                fc->write_ibi_reg(fc,dma2_010,v0x0);
+                fc->write_ibi_reg(fc,dma2_014,v0x4);
+                fc->write_ibi_reg(fc,dma2_01c,v0xc);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_dma_config);
+
+static int flexcop_dma_remap(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, int onoff)
+{
+        flexcop_ibi_register r = (dma_idx & FC_DMA_1) ? dma1_00c : dma2_01c;
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,r);
+        v.dma_0xc.remap_enable = onoff;
+        fc->write_ibi_reg(fc,r,v);
+        return 0;
+}
+
+/* 1 cycles = 1.97 msec */
+int flexcop_dma_config_timer(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, u8 cycles)
+{
+        flexcop_ibi_register r = (dma_idx & FC_DMA_1) ? dma1_004 : dma2_014;
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,r);
+
+        flexcop_dma_remap(fc,dma_idx,0);
+
+        v.dma_0x4_write.dmatimer = cycles >> 1;
+        fc->write_ibi_reg(fc,r,v);
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_dma_config_timer);
+
+int flexcop_dma_config_packet_count(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, u8 packets)
+{
+        flexcop_ibi_register r = (dma_idx & FC_DMA_1) ? dma1_004 : dma2_014;
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,r);
+
+        flexcop_dma_remap(fc,dma_idx,1);
+
+        v.dma_0x4_remap.DMA_maxpackets = packets;
+        fc->write_ibi_reg(fc,r,v);
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_dma_config_packet_count);
diff --git a/drivers/media/dvb/b2c2/flexcop-eeprom.c b/drivers/media/dvb/b2c2/flexcop-eeprom.c
new file mode 100644
index 000000000000..bbcf070a178d
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-eeprom.c
@@ -0,0 +1,153 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-eeprom.c - eeprom access methods (currently only MAC address reading is used)
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+#if 0
+/*EEPROM (Skystar2 has one "24LC08B" chip on board) */
+static int eeprom_write(struct adapter *adapter, u16 addr, u8 *buf, u16 len)
+{
+        return flex_i2c_write(adapter, 0x20000000, 0x50, addr, buf, len);
+}
+
+static int eeprom_lrc_write(struct adapter *adapter, u32 addr, u32 len, u8 *wbuf, u8 *rbuf, int retries)
+{
+        int i;
+
+        for (i = 0; i < retries; i++) {
+                if (eeprom_write(adapter, addr, wbuf, len) == len) {
+                        if (eeprom_lrc_read(adapter, addr, len, rbuf, retries) == 1)
+                                return 1;
+                }
+        }
+
+        return 0;
+}
+
+/* These functions could be used to unlock SkyStar2 cards. */
+
+static int eeprom_writeKey(struct adapter *adapter, u8 *key, u32 len)
+{
+        u8 rbuf[20];
+        u8 wbuf[20];
+
+        if (len != 16)
+                return 0;
+
+        memcpy(wbuf, key, len);
+
+        wbuf[16] = 0;
+        wbuf[17] = 0;
+        wbuf[18] = 0;
+        wbuf[19] = calc_lrc(wbuf, 19);
+
+        return eeprom_lrc_write(adapter, 0x3e4, 20, wbuf, rbuf, 4);
+}
+
+static int eeprom_readKey(struct adapter *adapter, u8 *key, u32 len)
+{
+        u8 buf[20];
+
+        if (len != 16)
+                return 0;
+
+        if (eeprom_lrc_read(adapter, 0x3e4, 20, buf, 4) == 0)
+                return 0;
+
+        memcpy(key, buf, len);
+
+        return 1;
+}
+
+static char eeprom_set_mac_addr(struct adapter *adapter, char type, u8 *mac)
+{
+        u8 tmp[8];
+
+        if (type != 0) {
+                tmp[0] = mac[0];
+                tmp[1] = mac[1];
+                tmp[2] = mac[2];
+                tmp[3] = mac[5];
+                tmp[4] = mac[6];
+                tmp[5] = mac[7];
+
+        } else {
+
+                tmp[0] = mac[0];
+                tmp[1] = mac[1];
+                tmp[2] = mac[2];
+                tmp[3] = mac[3];
+                tmp[4] = mac[4];
+                tmp[5] = mac[5];
+        }
+
+        tmp[6] = 0;
+        tmp[7] = calc_lrc(tmp, 7);
+
+        if (eeprom_write(adapter, 0x3f8, tmp, 8) == 8)
+                return 1;
+
+        return 0;
+}
+
+static int flexcop_eeprom_read(struct flexcop_device *fc, u16 addr, u8 *buf, u16 len)
+{
+        return fc->i2c_request(fc,FC_READ,FC_I2C_PORT_EEPROM,0x50,addr,buf,len);
+}
+
+#endif
+
+static u8 calc_lrc(u8 *buf, int len)
+{
+        int i;
+        u8 sum = 0;
+        for (i = 0; i < len; i++)
+                sum = sum ^ buf[i];
+        return sum;
+}
+
+static int flexcop_eeprom_request(struct flexcop_device *fc, flexcop_access_op_t op, u16 addr, u8 *buf, u16 len, int retries)
+{
+        int i,ret = 0;
+        u8 chipaddr =  0x50 | ((addr >> 8) & 3);
+        for (i = 0; i < retries; i++)
+                if ((ret = fc->i2c_request(fc,op,FC_I2C_PORT_EEPROM,chipaddr,addr & 0xff,buf,len)) == 0)
+                        break;
+        return ret;
+}
+
+static int flexcop_eeprom_lrc_read(struct flexcop_device *fc, u16 addr, u8 *buf, u16 len, int retries)
+{
+        int ret = flexcop_eeprom_request(fc,FC_READ,addr,buf,len,retries);
+        if (ret == 0)
+                if (calc_lrc(buf, len - 1) != buf[len - 1])
+                        ret = -EINVAL;
+        return ret;
+}
+
+/* JJ's comment about extended == 1: it is not presently used anywhere but was
+ * added to the low-level functions for possible support of EUI64
+ */
+int flexcop_eeprom_check_mac_addr(struct flexcop_device *fc, int extended)
+{
+        u8 buf[8];
+        int ret = 0;
+
+        if ((ret = flexcop_eeprom_lrc_read(fc,0x3f8,buf,8,4)) == 0) {
+                if (extended != 0) {
+                        err("TODO: extended (EUI64) MAC addresses aren't completely supported yet");
+                        ret = -EINVAL;
+/*                      memcpy(fc->dvb_adapter.proposed_mac,buf,3);
+                        mac[3] = 0xfe;
+                        mac[4] = 0xff;
+                        memcpy(&fc->dvb_adapter.proposed_mac[3],&buf[5],3); */
+                } else
+                        memcpy(fc->dvb_adapter.proposed_mac,buf,6);
+        }
+        return ret;
+}
+EXPORT_SYMBOL(flexcop_eeprom_check_mac_addr);
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
new file mode 100644
index 000000000000..71be400e9aeb
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -0,0 +1,403 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-fe-tuner.c - methods for attaching a frontend and controlling DiSEqC.
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+#include "stv0299.h"
+#include "mt352.h"
+#include "nxt2002.h"
+#include "stv0297.h"
+#include "mt312.h"
+
+/* lnb control */
+
+static int flexcop_set_voltage(struct dvb_frontend *fe, fe_sec_voltage_t voltage)
+{
+        struct flexcop_device *fc = fe->dvb->priv;
+        flexcop_ibi_value v;
+        deb_tuner("polarity/voltage = %u\n", voltage);
+
+        v = fc->read_ibi_reg(fc, misc_204);
+        switch (voltage) {
+                case SEC_VOLTAGE_OFF:
+                        v.misc_204.ACPI1_sig = 1;
+                        break;
+                case SEC_VOLTAGE_13:
+                        v.misc_204.ACPI1_sig = 0;
+                        v.misc_204.LNB_L_H_sig = 0;
+                        break;
+                case SEC_VOLTAGE_18:
+                        v.misc_204.ACPI1_sig = 0;
+                        v.misc_204.LNB_L_H_sig = 1;
+                        break;
+                default:
+                        err("unknown SEC_VOLTAGE value");
+                        return -EINVAL;
+        }
+        return fc->write_ibi_reg(fc, misc_204, v);
+}
+
+static int flexcop_sleep(struct dvb_frontend* fe)
+{
+        struct flexcop_device *fc = fe->dvb->priv;
+/*      flexcop_ibi_value v = fc->read_ibi_reg(fc,misc_204); */
+
+        if (fc->fe_sleep)
+                return fc->fe_sleep(fe);
+
+/*      v.misc_204.ACPI3_sig = 1;
+        fc->write_ibi_reg(fc,misc_204,v);*/
+
+        return 0;
+}
+
+static int flexcop_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+{
+        /* u16 wz_half_period_for_45_mhz[] = { 0x01ff, 0x0154, 0x00ff, 0x00cc }; */
+        struct flexcop_device *fc = fe->dvb->priv;
+        flexcop_ibi_value v;
+        u16 ax;
+        v.raw = 0;
+
+        deb_tuner("tone = %u\n",tone);
+
+        switch (tone) {
+                case SEC_TONE_ON:
+                        ax = 0x01ff;
+                        break;
+                case SEC_TONE_OFF:
+                        ax = 0;
+                        break;
+                default:
+                        err("unknown SEC_TONE value");
+                        return -EINVAL;
+        }
+
+        v.lnb_switch_freq_200.LNB_CTLPrescaler_sig = 1; /* divide by 2 */
+
+        v.lnb_switch_freq_200.LNB_CTLHighCount_sig = ax;
+        v.lnb_switch_freq_200.LNB_CTLLowCount_sig  = ax == 0 ? 0x1ff : ax;
+
+        return fc->write_ibi_reg(fc,lnb_switch_freq_200,v);
+}
+
+static void flexcop_diseqc_send_bit(struct dvb_frontend* fe, int data)
+{
+        flexcop_set_tone(fe, SEC_TONE_ON);
+        udelay(data ? 500 : 1000);
+        flexcop_set_tone(fe, SEC_TONE_OFF);
+        udelay(data ? 1000 : 500);
+}
+
+static void flexcop_diseqc_send_byte(struct dvb_frontend* fe, int data)
+{
+        int i, par = 1, d;
+
+        for (i = 7; i >= 0; i--) {
+                d = (data >> i) & 1;
+                par ^= d;
+                flexcop_diseqc_send_bit(fe, d);
+        }
+
+        flexcop_diseqc_send_bit(fe, par);
+}
+
+static int flexcop_send_diseqc_msg(struct dvb_frontend* fe, int len, u8 *msg, unsigned long burst)
+{
+        int i;
+
+        flexcop_set_tone(fe, SEC_TONE_OFF);
+        mdelay(16);
+
+        for (i = 0; i < len; i++)
+                flexcop_diseqc_send_byte(fe,msg[i]);
+
+        mdelay(16);
+
+        if (burst != -1) {
+                if (burst)
+                        flexcop_diseqc_send_byte(fe, 0xff);
+                else {
+                        flexcop_set_tone(fe, SEC_TONE_ON);
+                        udelay(12500);
+                        flexcop_set_tone(fe, SEC_TONE_OFF);
+                }
+                msleep(20);
+        }
+        return 0;
+}
+
+static int flexcop_diseqc_send_master_cmd(struct dvb_frontend* fe, struct dvb_diseqc_master_cmd* cmd)
+{
+        return flexcop_send_diseqc_msg(fe, cmd->msg_len, cmd->msg, 0);
+}
+
+static int flexcop_diseqc_send_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t minicmd)
+{
+        return flexcop_send_diseqc_msg(fe, 0, NULL, minicmd);
+}
+
+/* dvb-s stv0299 */
+static int samsung_tbmu24112_set_symbol_rate(struct dvb_frontend* fe, u32 srate, u32 ratio)
+{
+        u8 aclk = 0;
+        u8 bclk = 0;
+
+        if (srate < 1500000) { aclk = 0xb7; bclk = 0x47; }
+        else if (srate < 3000000) { aclk = 0xb7; bclk = 0x4b; }
+        else if (srate < 7000000) { aclk = 0xb7; bclk = 0x4f; }
+        else if (srate < 14000000) { aclk = 0xb7; bclk = 0x53; }
+        else if (srate < 30000000) { aclk = 0xb6; bclk = 0x53; }
+        else if (srate < 45000000) { aclk = 0xb4; bclk = 0x51; }
+
+        stv0299_writereg (fe, 0x13, aclk);
+        stv0299_writereg (fe, 0x14, bclk);
+        stv0299_writereg (fe, 0x1f, (ratio >> 16) & 0xff);
+        stv0299_writereg (fe, 0x20, (ratio >>  8) & 0xff);
+        stv0299_writereg (fe, 0x21, (ratio      ) & 0xf0);
+
+        return 0;
+}
+
+static int samsung_tbmu24112_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
+{
+        u8 buf[4];
+        u32 div;
+        struct i2c_msg msg = { .addr = 0x61, .flags = 0, .buf = buf, .len = sizeof(buf) };
+        struct flexcop_device *fc = fe->dvb->priv;
+
+        div = params->frequency / 125;
+
+        buf[0] = (div >> 8) & 0x7f;
+        buf[1] = div & 0xff;
+        buf[2] = 0x84;  /* 0xC4 */
+        buf[3] = 0x08;
+
+        if (params->frequency < 1500000) buf[3] |= 0x10;
+
+        if (i2c_transfer(&fc->i2c_adap, &msg, 1) != 1)
+                return -EIO;
+        return 0;
+}
+
+static u8 samsung_tbmu24112_inittab[] = {
+             0x01, 0x15,
+             0x02, 0x30,
+             0x03, 0x00,
+             0x04, 0x7D,
+             0x05, 0x35,
+             0x06, 0x02,
+             0x07, 0x00,
+             0x08, 0xC3,
+             0x0C, 0x00,
+             0x0D, 0x81,
+             0x0E, 0x23,
+             0x0F, 0x12,
+             0x10, 0x7E,
+             0x11, 0x84,
+             0x12, 0xB9,
+             0x13, 0x88,
+             0x14, 0x89,
+             0x15, 0xC9,
+             0x16, 0x00,
+             0x17, 0x5C,
+             0x18, 0x00,
+             0x19, 0x00,
+             0x1A, 0x00,
+             0x1C, 0x00,
+             0x1D, 0x00,
+             0x1E, 0x00,
+             0x1F, 0x3A,
+             0x20, 0x2E,
+             0x21, 0x80,
+             0x22, 0xFF,
+             0x23, 0xC1,
+             0x28, 0x00,
+             0x29, 0x1E,
+             0x2A, 0x14,
+             0x2B, 0x0F,
+             0x2C, 0x09,
+             0x2D, 0x05,
+             0x31, 0x1F,
+             0x32, 0x19,
+             0x33, 0xFE,
+             0x34, 0x93,
+             0xff, 0xff,
+};
+
+static struct stv0299_config samsung_tbmu24112_config = {
+        .demod_address = 0x68,
+        .inittab = samsung_tbmu24112_inittab,
+        .mclk = 88000000UL,
+        .invert = 0,
+        .enhanced_tuning = 0,
+        .skip_reinit = 0,
+        .lock_output = STV0229_LOCKOUTPUT_LK,
+        .volt13_op0_op1 = STV0299_VOLT13_OP1,
+        .min_delay_ms = 100,
+        .set_symbol_rate = samsung_tbmu24112_set_symbol_rate,
+        .pll_set = samsung_tbmu24112_pll_set,
+};
+
+/* dvb-t mt352 */
+static int samsung_tdtc9251dh0_demod_init(struct dvb_frontend* fe)
+{
+        static u8 mt352_clock_config [] = { 0x89, 0x18, 0x2d };
+        static u8 mt352_reset [] = { 0x50, 0x80 };
+        static u8 mt352_adc_ctl_1_cfg [] = { 0x8E, 0x40 };
+        static u8 mt352_agc_cfg [] = { 0x67, 0x28, 0xa1 };
+        static u8 mt352_capt_range_cfg[] = { 0x75, 0x32 };
+
+        mt352_write(fe, mt352_clock_config, sizeof(mt352_clock_config));
+        udelay(2000);
+        mt352_write(fe, mt352_reset, sizeof(mt352_reset));
+        mt352_write(fe, mt352_adc_ctl_1_cfg, sizeof(mt352_adc_ctl_1_cfg));
+
+        mt352_write(fe, mt352_agc_cfg, sizeof(mt352_agc_cfg));
+        mt352_write(fe, mt352_capt_range_cfg, sizeof(mt352_capt_range_cfg));
+
+        return 0;
+}
+
+static int samsung_tdtc9251dh0_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params, u8* pllbuf)
+{
+        u32 div;
+        unsigned char bs = 0;
+
+        #define IF_FREQUENCYx6 217    /* 6 * 36.16666666667MHz */
+        div = (((params->frequency + 83333) * 3) / 500000) + IF_FREQUENCYx6;
+
+        if (params->frequency >= 48000000 && params->frequency <= 154000000) bs = 0x09;
+        if (params->frequency >= 161000000 && params->frequency <= 439000000) bs = 0x0a;
+        if (params->frequency >= 447000000 && params->frequency <= 863000000) bs = 0x08;
+
+        pllbuf[0] = 0xc2; /* Note: non-linux standard PLL i2c address */
+        pllbuf[1] = div >> 8;
+        pllbuf[2] = div & 0xff;
+        pllbuf[3] = 0xcc;
+        pllbuf[4] = bs;
+
+        return 0;
+}
+
+static struct mt352_config samsung_tdtc9251dh0_config = {
+
+        .demod_address = 0x0f,
+        .demod_init = samsung_tdtc9251dh0_demod_init,
+        .pll_set = samsung_tdtc9251dh0_pll_set,
+};
+
+static int nxt2002_request_firmware(struct dvb_frontend* fe, const struct firmware **fw, char* name)
+{
+        struct flexcop_device *fc = fe->dvb->priv;
+        return request_firmware(fw, name, fc->dev);
+}
+
+static struct nxt2002_config samsung_tbmv_config = {
+        .demod_address = 0x0a,
+        .request_firmware = nxt2002_request_firmware,
+};
+
+static int skystar23_samsung_tbdu18132_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
+{
+        u8 buf[4];
+        u32 div;
+        struct i2c_msg msg = { .addr = 0x61, .flags = 0, .buf = buf, .len = sizeof(buf) };
+        struct flexcop_device *fc = fe->dvb->priv;
+
+        div = (params->frequency + (125/2)) / 125;
+
+        buf[0] = (div >> 8) & 0x7f;
+        buf[1] = (div >> 0) & 0xff;
+        buf[2] = 0x84 | ((div >> 10) & 0x60);
+        buf[3] = 0x80;
+
+        if (params->frequency < 1550000)
+                buf[3] |= 0x02;
+
+        if (i2c_transfer(&fc->i2c_adap, &msg, 1) != 1)
+                return -EIO;
+        return 0;
+}
+
+static struct mt312_config skystar23_samsung_tbdu18132_config = {
+
+        .demod_address = 0x0e,
+        .pll_set = skystar23_samsung_tbdu18132_pll_set,
+};
+
+static struct stv0297_config alps_tdee4_stv0297_config = {
+        .demod_address = 0x1c,
+//      .invert = 1,
+//      .pll_set = alps_tdee4_stv0297_pll_set,
+};
+
+/* try to figure out the frontend, each card/box can have on of the following list */
+int flexcop_frontend_init(struct flexcop_device *fc)
+{
+        /* try the sky v2.6 (stv0299/Samsung tbmu24112(sl1935)) */
+        if ((fc->fe = stv0299_attach(&samsung_tbmu24112_config, &fc->i2c_adap)) != NULL) {
+                fc->fe->ops->set_voltage = flexcop_set_voltage;
+
+                fc->fe_sleep             = fc->fe->ops->sleep;
+                fc->fe->ops->sleep       = flexcop_sleep;
+
+                fc->dev_type          = FC_SKY;
+                info("found the stv0299 at i2c address: 0x%02x",samsung_tbmu24112_config.demod_address);
+        } else
+        /* try the air dvb-t (mt352/Samsung tdtc9251dh0(??)) */
+        if ((fc->fe = mt352_attach(&samsung_tdtc9251dh0_config, &fc->i2c_adap)) != NULL ) {
+                fc->dev_type          = FC_AIR_DVB;
+                info("found the mt352 at i2c address: 0x%02x",samsung_tdtc9251dh0_config.demod_address);
+        } else
+        /* try the air atsc (nxt2002) */
+        if ((fc->fe = nxt2002_attach(&samsung_tbmv_config, &fc->i2c_adap)) != NULL) {
+                fc->dev_type          = FC_AIR_ATSC;
+                info("found the nxt2002 at i2c address: 0x%02x",samsung_tbmv_config.demod_address);
+        } else
+        /* try the cable dvb (stv0297) */
+        if ((fc->fe = stv0297_attach(&alps_tdee4_stv0297_config, &fc->i2c_adap, 0xf8)) != NULL) {
+                fc->dev_type                        = FC_CABLE;
+                info("found the stv0297 at i2c address: 0x%02x",alps_tdee4_stv0297_config.demod_address);
+        } else
+        /* try the sky v2.3 (vp310/Samsung tbdu18132(tsa5059)) */
+        if ((fc->fe = vp310_attach(&skystar23_samsung_tbdu18132_config, &fc->i2c_adap)) != NULL) {
+                fc->fe->ops->diseqc_send_master_cmd = flexcop_diseqc_send_master_cmd;
+                fc->fe->ops->diseqc_send_burst      = flexcop_diseqc_send_burst;
+                fc->fe->ops->set_tone               = flexcop_set_tone;
+                fc->fe->ops->set_voltage            = flexcop_set_voltage;
+
+                fc->fe_sleep                        = fc->fe->ops->sleep;
+                fc->fe->ops->sleep                  = flexcop_sleep;
+
+                fc->dev_type                        = FC_SKY_OLD;
+                info("found the vp310 (aka mt312) at i2c address: 0x%02x",skystar23_samsung_tbdu18132_config.demod_address);
+        }
+
+        if (fc->fe == NULL) {
+                err("no frontend driver found for this B2C2/FlexCop adapter");
+                return -ENODEV;
+        } else {
+                if (dvb_register_frontend(&fc->dvb_adapter, fc->fe)) {
+                        err("frontend registration failed!");
+                        if (fc->fe->ops->release != NULL)
+                                fc->fe->ops->release(fc->fe);
+                        fc->fe = NULL;
+                        return -EINVAL;
+                }
+        }
+        fc->init_state |= FC_STATE_FE_INIT;
+        return 0;
+}
+
+void flexcop_frontend_exit(struct flexcop_device *fc)
+{
+        if (fc->init_state & FC_STATE_FE_INIT)
+                dvb_unregister_frontend(fc->fe);
+
+        fc->init_state &= ~FC_STATE_FE_INIT;
+}
diff --git a/drivers/media/dvb/b2c2/flexcop-hw-filter.c b/drivers/media/dvb/b2c2/flexcop-hw-filter.c
new file mode 100644
index 000000000000..2baf43d3ce8f
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-hw-filter.c
@@ -0,0 +1,204 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-hw-filter.c - pid and mac address filtering and corresponding control functions.
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+static void flexcop_rcv_data_ctrl(struct flexcop_device *fc, int onoff)
+{
+        flexcop_set_ibi_value(ctrl_208,Rcv_Data_sig,onoff);
+}
+
+void flexcop_smc_ctrl(struct flexcop_device *fc, int onoff)
+{
+        flexcop_set_ibi_value(ctrl_208,SMC_Enable_sig,onoff);
+}
+
+void flexcop_null_filter_ctrl(struct flexcop_device *fc, int onoff)
+{
+        flexcop_set_ibi_value(ctrl_208,Null_filter_sig,onoff);
+}
+
+void flexcop_set_mac_filter(struct flexcop_device *fc, u8 mac[6])
+{
+        flexcop_ibi_value v418,v41c;
+        v41c = fc->read_ibi_reg(fc,mac_address_41c);
+
+        v418.mac_address_418.MAC1 = mac[0];
+        v418.mac_address_418.MAC2 = mac[1];
+        v418.mac_address_418.MAC3 = mac[2];
+        v418.mac_address_418.MAC6 = mac[3];
+        v41c.mac_address_41c.MAC7 = mac[4];
+        v41c.mac_address_41c.MAC8 = mac[5];
+
+        fc->write_ibi_reg(fc,mac_address_418,v418);
+        fc->write_ibi_reg(fc,mac_address_41c,v41c);
+}
+
+void flexcop_mac_filter_ctrl(struct flexcop_device *fc, int onoff)
+{
+        flexcop_set_ibi_value(ctrl_208,MAC_filter_Mode_sig,onoff);
+}
+
+static void flexcop_pid_group_filter(struct flexcop_device *fc, u16 pid, u16 mask)
+{
+        /* index_reg_310.extra_index_reg need to 0 or 7 to work */
+        flexcop_ibi_value v30c;
+        v30c.pid_filter_30c_ext_ind_0_7.Group_PID = pid;
+        v30c.pid_filter_30c_ext_ind_0_7.Group_mask = mask;
+        fc->write_ibi_reg(fc,pid_filter_30c,v30c);
+}
+
+static void flexcop_pid_group_filter_ctrl(struct flexcop_device *fc, int onoff)
+{
+        flexcop_set_ibi_value(ctrl_208,Mask_filter_sig,onoff);
+}
+
+/* this fancy define reduces the code size of the quite similar PID controlling of
+ * the first 6 PIDs
+ */
+
+#define pid_ctrl(vregname,field,enablefield,trans_field,transval) \
+        flexcop_ibi_value vpid = fc->read_ibi_reg(fc, vregname), \
+                                          v208 = fc->read_ibi_reg(fc, ctrl_208); \
+\
+        vpid.vregname.field = onoff ? pid : 0x1fff; \
+        vpid.vregname.trans_field = transval; \
+        v208.ctrl_208.enablefield = onoff; \
+\
+        fc->write_ibi_reg(fc,vregname,vpid); \
+        fc->write_ibi_reg(fc,ctrl_208,v208);
+
+static void flexcop_pid_Stream1_PID_ctrl(struct flexcop_device *fc, u16 pid, int onoff)
+{
+        pid_ctrl(pid_filter_300,Stream1_PID,Stream1_filter_sig,Stream1_trans,0);
+}
+
+static void flexcop_pid_Stream2_PID_ctrl(struct flexcop_device *fc, u16 pid, int onoff)
+{
+        pid_ctrl(pid_filter_300,Stream2_PID,Stream2_filter_sig,Stream2_trans,0);
+}
+
+static void flexcop_pid_PCR_PID_ctrl(struct flexcop_device *fc, u16 pid, int onoff)
+{
+        pid_ctrl(pid_filter_304,PCR_PID,PCR_filter_sig,PCR_trans,0);
+}
+
+static void flexcop_pid_PMT_PID_ctrl(struct flexcop_device *fc, u16 pid, int onoff)
+{
+        pid_ctrl(pid_filter_304,PMT_PID,PMT_filter_sig,PMT_trans,0);
+}
+
+static void flexcop_pid_EMM_PID_ctrl(struct flexcop_device *fc, u16 pid, int onoff)
+{
+        pid_ctrl(pid_filter_308,EMM_PID,EMM_filter_sig,EMM_trans,0);
+}
+
+static void flexcop_pid_ECM_PID_ctrl(struct flexcop_device *fc, u16 pid, int onoff)
+{
+        pid_ctrl(pid_filter_308,ECM_PID,ECM_filter_sig,ECM_trans,0);
+}
+
+static void flexcop_pid_control(struct flexcop_device *fc, int index, u16 pid,int onoff)
+{
+        if (pid == 0x2000)
+                return;
+
+        deb_ts("setting pid: %5d %04x at index %d '%s'\n",pid,pid,index,onoff ? "on" : "off");
+
+        /* We could use bit magic here to reduce source code size.
+         * I decided against it, but to use the real register names */
+        switch (index) {
+                case 0: flexcop_pid_Stream1_PID_ctrl(fc,pid,onoff); break;
+                case 1: flexcop_pid_Stream2_PID_ctrl(fc,pid,onoff); break;
+                case 2: flexcop_pid_PCR_PID_ctrl(fc,pid,onoff); break;
+                case 3: flexcop_pid_PMT_PID_ctrl(fc,pid,onoff); break;
+                case 4: flexcop_pid_EMM_PID_ctrl(fc,pid,onoff); break;
+                case 5: flexcop_pid_ECM_PID_ctrl(fc,pid,onoff); break;
+                default:
+                        if (fc->has_32_hw_pid_filter && index < 38) {
+                                flexcop_ibi_value vpid,vid;
+
+                                /* set the index */
+                                vid = fc->read_ibi_reg(fc,index_reg_310);
+                                vid.index_reg_310.index_reg = index - 6;
+                                fc->write_ibi_reg(fc,index_reg_310, vid);
+
+                                vpid = fc->read_ibi_reg(fc,pid_n_reg_314);
+                                vpid.pid_n_reg_314.PID = onoff ? pid : 0x1fff;
+                                vpid.pid_n_reg_314.PID_enable_bit = onoff;
+                                fc->write_ibi_reg(fc,pid_n_reg_314, vpid);
+                        }
+                        break;
+        }
+}
+
+static int flexcop_toggle_fullts_streaming(struct flexcop_device *fc,int onoff)
+{
+        if (fc->fullts_streaming_state != onoff) {
+                deb_ts("%s full TS transfer\n",onoff ? "enabling" : "disabling");
+                flexcop_pid_group_filter(fc, 0, 0x1fe0 * (!onoff));
+                flexcop_pid_group_filter_ctrl(fc,onoff);
+                fc->fullts_streaming_state = onoff;
+        }
+        return 0;
+}
+
+int flexcop_pid_feed_control(struct flexcop_device *fc, struct dvb_demux_feed *dvbdmxfeed, int onoff)
+{
+        int max_pid_filter = 6 + fc->has_32_hw_pid_filter*32;
+
+        fc->feedcount += onoff ? 1 : -1;
+        if (dvbdmxfeed->index >= max_pid_filter)
+                fc->extra_feedcount += onoff ? 1 : -1;
+
+        /* toggle complete-TS-streaming when:
+         * - pid_filtering is not enabled and it is the first or last feed requested
+         * - pid_filtering is enabled,
+         *   - but the number of requested feeds is exceeded
+         *   - or the requested pid is 0x2000 */
+
+        if (!fc->pid_filtering && fc->feedcount == onoff)
+                flexcop_toggle_fullts_streaming(fc,onoff);
+
+        if (fc->pid_filtering) {
+                flexcop_pid_control(fc,dvbdmxfeed->index,dvbdmxfeed->pid,onoff);
+
+                if (fc->extra_feedcount > 0)
+                        flexcop_toggle_fullts_streaming(fc,1);
+                else if (dvbdmxfeed->pid == 0x2000)
+                        flexcop_toggle_fullts_streaming(fc,onoff);
+                else
+                        flexcop_toggle_fullts_streaming(fc,0);
+        }
+
+        /* if it was the first or last feed request change the stream-status */
+        if (fc->feedcount == onoff) {
+                flexcop_rcv_data_ctrl(fc,onoff);
+                if (fc->stream_control)
+                        fc->stream_control(fc,onoff);
+        }
+
+        return 0;
+}
+
+void flexcop_hw_filter_init(struct flexcop_device *fc)
+{
+        int i;
+        flexcop_ibi_value v;
+        for (i = 0; i < 6 + 32*fc->has_32_hw_pid_filter; i++)
+                flexcop_pid_control(fc,i,0x1fff,0);
+
+        flexcop_pid_group_filter(fc, 0, 0x1fe0);
+        flexcop_pid_group_filter_ctrl(fc,0);
+
+        v = fc->read_ibi_reg(fc,pid_filter_308);
+        v.pid_filter_308.EMM_filter_4 = 1;
+        v.pid_filter_308.EMM_filter_6 = 0;
+        fc->write_ibi_reg(fc,pid_filter_308,v);
+
+        flexcop_null_filter_ctrl(fc, 1);
+}
diff --git a/drivers/media/dvb/b2c2/flexcop-i2c.c b/drivers/media/dvb/b2c2/flexcop-i2c.c
new file mode 100644
index 000000000000..be4266d4ae91
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-i2c.c
@@ -0,0 +1,210 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-i2c.c - flexcop internal 2Wire bus (I2C) and dvb i2c initialization
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+#define FC_MAX_I2C_RETRIES 100000
+
+static int flexcop_i2c_operation(struct flexcop_device *fc, flexcop_ibi_value *r100)
+{
+        int i;
+        flexcop_ibi_value r;
+
+        r100->tw_sm_c_100.working_start = 1;
+        deb_i2c("r100 before: %08x\n",r100->raw);
+
+        fc->write_ibi_reg(fc, tw_sm_c_100, ibi_zero);
+        fc->write_ibi_reg(fc, tw_sm_c_100, *r100); /* initiating i2c operation */
+
+        for (i = 0; i < FC_MAX_I2C_RETRIES; i++) {
+                r = fc->read_ibi_reg(fc, tw_sm_c_100);
+
+                if (!r.tw_sm_c_100.no_base_addr_ack_error) {
+                        if (r.tw_sm_c_100.st_done) {  /* && !r.tw_sm_c_100.working_start */
+                                *r100 = r;
+                                deb_i2c("i2c success\n");
+                                return 0;
+                        }
+                } else {
+                        deb_i2c("suffering from an i2c ack_error\n");
+                        return -EREMOTEIO;
+                }
+        }
+        deb_i2c("tried %d times i2c operation, never finished or too many ack errors.\n",i);
+        return -EREMOTEIO;
+}
+
+static int flexcop_i2c_read4(struct flexcop_device *fc, flexcop_ibi_value r100, u8 *buf)
+{
+        flexcop_ibi_value r104;
+        int len = r100.tw_sm_c_100.total_bytes, /* remember total_bytes is buflen-1 */
+                ret;
+
+        if ((ret = flexcop_i2c_operation(fc,&r100)) != 0) {
+                /* The Cablestar needs a different kind of i2c-transfer (does not
+                 * support "Repeat Start"):
+                 * wait for the ACK failure,
+                 * and do a subsequent read with the Bit 30 enabled
+                 */
+                r100.tw_sm_c_100.no_base_addr_ack_error = 1;
+                if ((ret = flexcop_i2c_operation(fc,&r100)) != 0) {
+                        deb_i2c("no_base_addr read failed. %d\n",ret);
+                        return ret;
+                }
+        }
+
+        buf[0] = r100.tw_sm_c_100.data1_reg;
+
+        if (len > 0) {
+                r104 = fc->read_ibi_reg(fc,tw_sm_c_104);
+                deb_i2c("read: r100: %08x, r104: %08x\n",r100.raw,r104.raw);
+
+                /* there is at least one more byte, otherwise we wouldn't be here */
+                buf[1] = r104.tw_sm_c_104.data2_reg;
+                if (len > 1) buf[2] = r104.tw_sm_c_104.data3_reg;
+                if (len > 2) buf[3] = r104.tw_sm_c_104.data4_reg;
+        }
+
+        return 0;
+}
+
+static int flexcop_i2c_write4(struct flexcop_device *fc, flexcop_ibi_value r100, u8 *buf)
+{
+        flexcop_ibi_value r104;
+        int len = r100.tw_sm_c_100.total_bytes; /* remember total_bytes is buflen-1 */
+        r104.raw = 0;
+
+        /* there is at least one byte, otherwise we wouldn't be here */
+        r100.tw_sm_c_100.data1_reg = buf[0];
+
+        r104.tw_sm_c_104.data2_reg = len > 0 ? buf[1] : 0;
+        r104.tw_sm_c_104.data3_reg = len > 1 ? buf[2] : 0;
+        r104.tw_sm_c_104.data4_reg = len > 2 ? buf[3] : 0;
+
+        deb_i2c("write: r100: %08x, r104: %08x\n",r100.raw,r104.raw);
+
+        /* write the additional i2c data before doing the actual i2c operation */
+        fc->write_ibi_reg(fc,tw_sm_c_104,r104);
+        return flexcop_i2c_operation(fc,&r100);
+}
+
+int flexcop_i2c_request(struct flexcop_device *fc, flexcop_access_op_t op,
+                flexcop_i2c_port_t port, u8 chipaddr, u8 addr, u8 *buf, u16 len)
+{
+        int ret;
+        u16 bytes_to_transfer;
+        flexcop_ibi_value r100;
+
+        deb_i2c("op = %d\n",op);
+        r100.raw = 0;
+        r100.tw_sm_c_100.chipaddr = chipaddr;
+        r100.tw_sm_c_100.twoWS_rw = op;
+        r100.tw_sm_c_100.twoWS_port_reg = port;
+
+        while (len != 0) {
+                bytes_to_transfer = len > 4 ? 4 : len;
+
+                r100.tw_sm_c_100.total_bytes = bytes_to_transfer - 1;
+                r100.tw_sm_c_100.baseaddr = addr;
+
+                if (op == FC_READ)
+                        ret = flexcop_i2c_read4(fc, r100, buf);
+                else
+                        ret = flexcop_i2c_write4(fc,r100, buf);
+
+                if (ret < 0)
+                        return ret;
+
+                buf  += bytes_to_transfer;
+                addr += bytes_to_transfer;
+                len  -= bytes_to_transfer;
+        };
+
+        return 0;
+}
+/* exported for PCI i2c */
+EXPORT_SYMBOL(flexcop_i2c_request);
+
+/* master xfer callback for demodulator */
+static int flexcop_master_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msgs[], int num)
+{
+        struct flexcop_device *fc = i2c_get_adapdata(i2c_adap);
+        int i, ret = 0;
+
+        if (down_interruptible(&fc->i2c_sem))
+                return -ERESTARTSYS;
+
+        /* reading */
+        if (num == 2 &&
+                msgs[0].flags == 0 &&
+                msgs[1].flags == I2C_M_RD &&
+                msgs[0].buf != NULL &&
+                msgs[1].buf != NULL) {
+
+                ret = fc->i2c_request(fc, FC_READ, FC_I2C_PORT_DEMOD, msgs[0].addr, msgs[0].buf[0], msgs[1].buf, msgs[1].len);
+
+        } else for (i = 0; i < num; i++) { /* writing command */
+                if (msgs[i].flags != 0 || msgs[i].buf == NULL || msgs[i].len < 2) {
+                        ret = -EINVAL;
+                        break;
+                }
+
+                ret = fc->i2c_request(fc, FC_WRITE, FC_I2C_PORT_DEMOD, msgs[i].addr, msgs[i].buf[0], &msgs[i].buf[1], msgs[i].len - 1);
+        }
+
+        if (ret < 0)
+                err("i2c master_xfer failed");
+        else
+                ret = num;
+
+        up(&fc->i2c_sem);
+
+        return ret;
+}
+
+static u32 flexcop_i2c_func(struct i2c_adapter *adapter)
+{
+        return I2C_FUNC_I2C;
+}
+
+static struct i2c_algorithm flexcop_algo = {
+        .name                   = "FlexCop I2C algorithm",
+        .id                             = I2C_ALGO_BIT,
+        .master_xfer    = flexcop_master_xfer,
+        .functionality  = flexcop_i2c_func,
+};
+
+int flexcop_i2c_init(struct flexcop_device *fc)
+{
+        int ret;
+
+        sema_init(&fc->i2c_sem,1);
+
+        memset(&fc->i2c_adap, 0, sizeof(struct i2c_adapter));
+        strncpy(fc->i2c_adap.name, "B2C2 FlexCop device",I2C_NAME_SIZE);
+
+        i2c_set_adapdata(&fc->i2c_adap,fc);
+
+        fc->i2c_adap.class          = I2C_CLASS_TV_DIGITAL;
+        fc->i2c_adap.algo       = &flexcop_algo;
+        fc->i2c_adap.algo_data  = NULL;
+        fc->i2c_adap.id         = I2C_ALGO_BIT;
+
+        if ((ret = i2c_add_adapter(&fc->i2c_adap)) < 0)
+                return ret;
+
+        fc->init_state |= FC_STATE_I2C_INIT;
+        return 0;
+}
+
+void flexcop_i2c_exit(struct flexcop_device *fc)
+{
+        if (fc->init_state & FC_STATE_I2C_INIT)
+                i2c_del_adapter(&fc->i2c_adap);
+
+        fc->init_state &= ~FC_STATE_I2C_INIT;
+}
diff --git a/drivers/media/dvb/b2c2/flexcop-misc.c b/drivers/media/dvb/b2c2/flexcop-misc.c
new file mode 100644
index 000000000000..19e06da46774
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-misc.c
@@ -0,0 +1,66 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-misc.c - miscellaneous functions.
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+void flexcop_determine_revision(struct flexcop_device *fc)
+{
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,misc_204);
+
+        switch (v.misc_204.Rev_N_sig_revision_hi) {
+                case 0x2:
+                        deb_info("found a FlexCopII.\n");
+                        fc->rev = FLEXCOP_II;
+                        break;
+                case 0x3:
+                        deb_info("found a FlexCopIIb.\n");
+                        fc->rev = FLEXCOP_IIB;
+                        break;
+                case 0x0:
+                        deb_info("found a FlexCopIII.\n");
+                        fc->rev = FLEXCOP_III;
+                        break;
+                default:
+                        err("unkown FlexCop Revision: %x. Please report the linux-dvb@linuxtv.org.",v.misc_204.Rev_N_sig_revision_hi);
+                        break;
+        }
+
+        if ((fc->has_32_hw_pid_filter = v.misc_204.Rev_N_sig_caps))
+                deb_info("this FlexCop has the additional 32 hardware pid filter.\n");
+        else
+                deb_info("this FlexCop has only the 6 basic main hardware pid filter.\n");
+        /* bus parts have to decide if hw pid filtering is used or not. */
+}
+
+const char *flexcop_revision_names[] = {
+        "Unkown chip",
+        "FlexCopII",
+        "FlexCopIIb",
+        "FlexCopIII",
+};
+
+const char *flexcop_device_names[] = {
+        "Unkown device",
+        "AirStar 2 DVB-T",
+        "AirStar 2 ATSC",
+        "SkyStar 2 DVB-S",
+        "SkyStar 2 DVB-S (old version)",
+        "CableStar 2 DVB-C",
+};
+
+const char *flexcop_bus_names[] = {
+        "USB",
+        "PCI",
+};
+
+void flexcop_device_name(struct flexcop_device *fc,const char *prefix,const
+                char *suffix)
+{
+        info("%s '%s' at the '%s' bus controlled by a '%s' %s",prefix,
+                        flexcop_device_names[fc->dev_type],flexcop_bus_names[fc->bus_type],
+                        flexcop_revision_names[fc->rev],suffix);
+}
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
new file mode 100644
index 000000000000..ed717c0073d5
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -0,0 +1,381 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-pci.c - covers the PCI part including DMA transfers.
+ *
+ * see flexcop.c for copyright information.
+ */
+
+#define FC_LOG_PREFIX "flexcop-pci"
+#include "flexcop-common.h"
+
+static int enable_pid_filtering = 1;
+module_param(enable_pid_filtering, int, 0444);
+MODULE_PARM_DESC(enable_pid_filtering, "enable hardware pid filtering: supported values: 0 (fullts), 1");
+
+#ifdef CONFIG_DVB_B2C2_FLEXCOP_DEBUG
+#define dprintk(level,args...) \
+        do { if ((debug & level)) printk(args); } while (0)
+#define DEBSTATUS ""
+#else
+#define dprintk(level,args...)
+#define DEBSTATUS " (debugging is not enabled)"
+#endif
+
+#define deb_info(args...)  dprintk(0x01,args)
+#define deb_reg(args...)   dprintk(0x02,args)
+#define deb_ts(args...)    dprintk(0x04,args)
+#define deb_irq(args...)   dprintk(0x08,args)
+
+static int debug = 0;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "set debug level (1=info,2=regs,4=TS,8=irqdma (|-able))." DEBSTATUS);
+
+#define DRIVER_VERSION "0.1"
+#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
+
+struct flexcop_pci {
+        struct pci_dev *pdev;
+
+#define FC_PCI_INIT     0x01
+#define FC_PCI_DMA_INIT 0x02
+        int init_state;
+
+        void __iomem *io_mem;
+        u32 irq;
+/* buffersize (at least for DMA1, need to be % 188 == 0,
+ * this logic is required */
+#define FC_DEFAULT_DMA1_BUFSIZE (1280 * 188)
+#define FC_DEFAULT_DMA2_BUFSIZE (10 * 188)
+        struct flexcop_dma dma[2];
+
+        int active_dma1_addr; /* 0 = addr0 of dma1; 1 = addr1 of dma1 */
+        u32 last_dma1_cur_pos; /* position of the pointer last time the timer/packet irq occured */
+        int count;
+
+        spinlock_t irq_lock;
+
+        struct flexcop_device *fc_dev;
+};
+
+static int lastwreg,lastwval,lastrreg,lastrval;
+
+static flexcop_ibi_value flexcop_pci_read_ibi_reg (struct flexcop_device *fc, flexcop_ibi_register r)
+{
+        struct flexcop_pci *fc_pci = fc->bus_specific;
+        flexcop_ibi_value v;
+        v.raw = readl(fc_pci->io_mem + r);
+
+        if (lastrreg != r || lastrval != v.raw) {
+                lastrreg = r; lastrval = v.raw;
+                deb_reg("new rd: %3x: %08x\n",r,v.raw);
+        }
+
+        return v;
+}
+
+static int flexcop_pci_write_ibi_reg(struct flexcop_device *fc, flexcop_ibi_register r, flexcop_ibi_value v)
+{
+        struct flexcop_pci *fc_pci = fc->bus_specific;
+
+        if (lastwreg != r || lastwval != v.raw) {
+                lastwreg = r; lastwval = v.raw;
+                deb_reg("new wr: %3x: %08x\n",r,v.raw);
+        }
+
+        writel(v.raw, fc_pci->io_mem + r);
+        return 0;
+}
+
+/* When PID filtering is turned on, we use the timer IRQ, because small amounts
+ * of data need to be passed to the user space instantly as well. When PID
+ * filtering is turned off, we use the page-change-IRQ */
+static irqreturn_t flexcop_pci_irq(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct flexcop_pci *fc_pci = dev_id;
+        struct flexcop_device *fc = fc_pci->fc_dev;
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,irq_20c);
+        irqreturn_t ret = IRQ_HANDLED;
+
+        spin_lock_irq(&fc_pci->irq_lock);
+
+        if (v.irq_20c.DMA1_IRQ_Status == 1) {
+                if (fc_pci->active_dma1_addr == 0)
+                        flexcop_pass_dmx_packets(fc_pci->fc_dev,fc_pci->dma[0].cpu_addr0,fc_pci->dma[0].size / 188);
+                else
+                        flexcop_pass_dmx_packets(fc_pci->fc_dev,fc_pci->dma[0].cpu_addr1,fc_pci->dma[0].size / 188);
+
+                deb_irq("page change to page: %d\n",!fc_pci->active_dma1_addr);
+                fc_pci->active_dma1_addr = !fc_pci->active_dma1_addr;
+        } else if (v.irq_20c.DMA1_Timer_Status == 1) {
+                /* for the timer IRQ we only can use buffer dmx feeding, because we don't have
+                 * complete TS packets when reading from the DMA memory */
+                dma_addr_t cur_addr =
+                        fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2;
+                u32 cur_pos = cur_addr - fc_pci->dma[0].dma_addr0;
+
+                deb_irq("irq: %08x cur_addr: %08x: cur_pos: %08x, last_cur_pos: %08x ",
+                                v.raw,cur_addr,cur_pos,fc_pci->last_dma1_cur_pos);
+
+                /* buffer end was reached, restarted from the beginning
+                 * pass the data from last_cur_pos to the buffer end to the demux
+                 */
+                if (cur_pos < fc_pci->last_dma1_cur_pos) {
+                        deb_irq(" end was reached: passing %d bytes ",(fc_pci->dma[0].size*2 - 1) - fc_pci->last_dma1_cur_pos);
+                        flexcop_pass_dmx_data(fc_pci->fc_dev,
+                                        fc_pci->dma[0].cpu_addr0 + fc_pci->last_dma1_cur_pos,
+                                        (fc_pci->dma[0].size*2) - fc_pci->last_dma1_cur_pos);
+                        fc_pci->last_dma1_cur_pos = 0;
+                        fc_pci->count = 0;
+                }
+
+                if (cur_pos > fc_pci->last_dma1_cur_pos) {
+                        deb_irq(" passing %d bytes ",cur_pos - fc_pci->last_dma1_cur_pos);
+                        flexcop_pass_dmx_data(fc_pci->fc_dev,
+                                        fc_pci->dma[0].cpu_addr0 + fc_pci->last_dma1_cur_pos,
+                                        cur_pos - fc_pci->last_dma1_cur_pos);
+                }
+                deb_irq("\n");
+
+                fc_pci->last_dma1_cur_pos = cur_pos;
+        } else
+                ret = IRQ_NONE;
+
+        spin_unlock_irq(&fc_pci->irq_lock);
+
+/* packet count would be ideal for hw filtering, but it isn't working. Either
+ * the data book is wrong, or I'm unable to read it correctly */
+
+/*      if (v.irq_20c.DMA1_Size_IRQ_Status == 1) { packet counter */
+
+        return ret;
+}
+
+static int flexcop_pci_stream_control(struct flexcop_device *fc, int onoff)
+{
+        struct flexcop_pci *fc_pci = fc->bus_specific;
+        if (onoff) {
+                flexcop_dma_config(fc,&fc_pci->dma[0],FC_DMA_1,FC_DMA_SUBADDR_0 | FC_DMA_SUBADDR_1);
+                flexcop_dma_config(fc,&fc_pci->dma[1],FC_DMA_2,FC_DMA_SUBADDR_0 | FC_DMA_SUBADDR_1);
+                flexcop_dma_config_timer(fc,FC_DMA_1,1);
+
+                if (fc_pci->fc_dev->pid_filtering) {
+                        fc_pci->last_dma1_cur_pos = 0;
+                        flexcop_dma_control_timer_irq(fc,FC_DMA_1,1);
+                } else {
+                        fc_pci->active_dma1_addr = 0;
+                        flexcop_dma_control_size_irq(fc,FC_DMA_1,1);
+                }
+
+/*              flexcop_dma_config_packet_count(fc,FC_DMA_1,0xc0);
+                flexcop_dma_control_packet_irq(fc,FC_DMA_1,1); */
+
+                deb_irq("irqs enabled\n");
+        } else {
+                if (fc_pci->fc_dev->pid_filtering)
+                        flexcop_dma_control_timer_irq(fc,FC_DMA_1,0);
+                else
+                        flexcop_dma_control_size_irq(fc,FC_DMA_1,0);
+
+//              flexcop_dma_control_packet_irq(fc,FC_DMA_1,0);
+                deb_irq("irqs disabled\n");
+        }
+
+        return 0;
+}
+
+static int flexcop_pci_dma_init(struct flexcop_pci *fc_pci)
+{
+        int ret;
+        if ((ret = flexcop_dma_allocate(fc_pci->pdev,&fc_pci->dma[0],FC_DEFAULT_DMA1_BUFSIZE)) != 0)
+                return ret;
+
+        if ((ret = flexcop_dma_allocate(fc_pci->pdev,&fc_pci->dma[1],FC_DEFAULT_DMA2_BUFSIZE)) != 0)
+                goto dma1_free;
+
+        flexcop_sram_set_dest(fc_pci->fc_dev,FC_SRAM_DEST_MEDIA | FC_SRAM_DEST_NET, FC_SRAM_DEST_TARGET_DMA1);
+        flexcop_sram_set_dest(fc_pci->fc_dev,FC_SRAM_DEST_CAO   | FC_SRAM_DEST_CAI, FC_SRAM_DEST_TARGET_DMA2);
+
+        fc_pci->init_state |= FC_PCI_DMA_INIT;
+        goto success;
+dma1_free:
+        flexcop_dma_free(&fc_pci->dma[0]);
+
+success:
+        return ret;
+}
+
+static void flexcop_pci_dma_exit(struct flexcop_pci *fc_pci)
+{
+        if (fc_pci->init_state & FC_PCI_DMA_INIT) {
+                flexcop_dma_free(&fc_pci->dma[0]);
+                flexcop_dma_free(&fc_pci->dma[1]);
+        }
+        fc_pci->init_state &= ~FC_PCI_DMA_INIT;
+}
+
+static int flexcop_pci_init(struct flexcop_pci *fc_pci)
+{
+        int ret;
+        u8 card_rev;
+
+        pci_read_config_byte(fc_pci->pdev, PCI_CLASS_REVISION, &card_rev);
+        info("card revision %x", card_rev);
+
+        if ((ret = pci_enable_device(fc_pci->pdev)) != 0)
+                return ret;
+
+        pci_set_master(fc_pci->pdev);
+
+        /* enable interrupts */
+        // pci_write_config_dword(pdev, 0x6c, 0x8000);
+
+        if ((ret = pci_request_regions(fc_pci->pdev, DRIVER_NAME)) != 0)
+                goto err_pci_disable_device;
+
+        fc_pci->io_mem = pci_iomap(fc_pci->pdev, 0, 0x800);
+
+        if (!fc_pci->io_mem) {
+                err("cannot map io memory\n");
+                ret = -EIO;
+                goto err_pci_release_regions;
+        }
+
+        pci_set_drvdata(fc_pci->pdev, fc_pci);
+
+        if ((ret = request_irq(fc_pci->pdev->irq, flexcop_pci_irq,
+                                        SA_SHIRQ, DRIVER_NAME, fc_pci)) != 0)
+                goto err_pci_iounmap;
+
+        spin_lock_init(&fc_pci->irq_lock);
+
+        fc_pci->init_state |= FC_PCI_INIT;
+        goto success;
+
+err_pci_iounmap:
+        pci_iounmap(fc_pci->pdev, fc_pci->io_mem);
+        pci_set_drvdata(fc_pci->pdev, NULL);
+err_pci_release_regions:
+        pci_release_regions(fc_pci->pdev);
+err_pci_disable_device:
+        pci_disable_device(fc_pci->pdev);
+
+success:
+        return ret;
+}
+
+static void flexcop_pci_exit(struct flexcop_pci *fc_pci)
+{
+        if (fc_pci->init_state & FC_PCI_INIT) {
+                free_irq(fc_pci->pdev->irq, fc_pci);
+                pci_iounmap(fc_pci->pdev, fc_pci->io_mem);
+                pci_set_drvdata(fc_pci->pdev, NULL);
+                pci_release_regions(fc_pci->pdev);
+                pci_disable_device(fc_pci->pdev);
+        }
+        fc_pci->init_state &= ~FC_PCI_INIT;
+}
+
+
+static int flexcop_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+{
+        struct flexcop_device *fc;
+        struct flexcop_pci *fc_pci;
+        int ret = -ENOMEM;
+
+        if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_pci))) == NULL) {
+                err("out of memory\n");
+                return -ENOMEM;
+        }
+
+/* general flexcop init */
+        fc_pci = fc->bus_specific;
+        fc_pci->fc_dev = fc;
+
+        fc->read_ibi_reg = flexcop_pci_read_ibi_reg;
+        fc->write_ibi_reg = flexcop_pci_write_ibi_reg;
+        fc->i2c_request = flexcop_i2c_request;
+        fc->get_mac_addr = flexcop_eeprom_check_mac_addr;
+
+        fc->stream_control = flexcop_pci_stream_control;
+
+        if (enable_pid_filtering)
+                info("will use the HW PID filter.");
+        else
+                info("will pass the complete TS to the demuxer.");
+
+        fc->pid_filtering = enable_pid_filtering;
+        fc->bus_type = FC_PCI;
+
+        fc->dev = &pdev->dev;
+        fc->owner = THIS_MODULE;
+
+/* bus specific part */
+        fc_pci->pdev = pdev;
+        if ((ret = flexcop_pci_init(fc_pci)) != 0)
+                goto err_kfree;
+
+/* init flexcop */
+        if ((ret = flexcop_device_initialize(fc)) != 0)
+                goto err_pci_exit;
+
+/* init dma */
+        if ((ret = flexcop_pci_dma_init(fc_pci)) != 0)
+                goto err_fc_exit;
+
+        goto success;
+err_fc_exit:
+        flexcop_device_exit(fc);
+err_pci_exit:
+        flexcop_pci_exit(fc_pci);
+err_kfree:
+        flexcop_device_kfree(fc);
+success:
+        return ret;
+}
+
+/* in theory every _exit function should be called exactly two times,
+ * here and in the bail-out-part of the _init-function
+ */
+static void flexcop_pci_remove(struct pci_dev *pdev)
+{
+        struct flexcop_pci *fc_pci = pci_get_drvdata(pdev);
+
+        flexcop_pci_dma_exit(fc_pci);
+        flexcop_device_exit(fc_pci->fc_dev);
+        flexcop_pci_exit(fc_pci);
+        flexcop_device_kfree(fc_pci->fc_dev);
+}
+
+static struct pci_device_id flexcop_pci_tbl[] = {
+        { PCI_DEVICE(0x13d0, 0x2103) },
+/*      { PCI_DEVICE(0x13d0, 0x2200) }, PCI FlexCopIII ? */
+        { },
+};
+
+MODULE_DEVICE_TABLE(pci, flexcop_pci_tbl);
+
+static struct pci_driver flexcop_pci_driver = {
+        .name = "Technisat/B2C2 FlexCop II/IIb/III PCI",
+        .id_table = flexcop_pci_tbl,
+        .probe = flexcop_pci_probe,
+        .remove = flexcop_pci_remove,
+};
+
+static int __init flexcop_pci_module_init(void)
+{
+        return pci_register_driver(&flexcop_pci_driver);
+}
+
+static void __exit flexcop_pci_module_exit(void)
+{
+        pci_unregister_driver(&flexcop_pci_driver);
+}
+
+module_init(flexcop_pci_module_init);
+module_exit(flexcop_pci_module_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_NAME);
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/b2c2/flexcop-reg.h b/drivers/media/dvb/b2c2/flexcop-reg.h
new file mode 100644
index 000000000000..5e131be55cb3
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-reg.h
@@ -0,0 +1,701 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-reg.h - register abstraction for FlexCopII, FlexCopIIb and FlexCopIII
+ *
+ * see flexcop.c for copyright information.
+ */
+#ifndef __FLEXCOP_REG_H__
+#define __FLEXCOP_REG_H__
+
+
+typedef enum {
+        FLEXCOP_UNK = 0,
+        FLEXCOP_II,
+        FLEXCOP_IIB,
+        FLEXCOP_III,
+} flexcop_revision_t;
+
+extern const char *flexcop_revision_names[];
+
+typedef enum {
+        FC_UNK = 0,
+        FC_AIR_DVB,
+        FC_AIR_ATSC,
+        FC_SKY,
+        FC_SKY_OLD,
+        FC_CABLE,
+} flexcop_device_type_t;
+
+typedef enum {
+        FC_USB = 0,
+        FC_PCI,
+} flexcop_bus_t;
+
+extern const char *flexcop_device_names[];
+
+/* FlexCop IBI Registers */
+
+/* flexcop_ibi_reg - a huge union representing the register structure */
+typedef union {
+        u32 raw;
+
+/* DMA 0x000 to 0x01c
+ * DMA1 0x000 to 0x00c
+ * DMA2 0x010 to 0x01c
+ */
+        struct {
+                u32 dma_0start        : 1;   /* set: data will be delivered to dma1_address0 */
+        u32 dma_0No_update    : 1;   /* set: dma1_cur_address will be updated, unset: no update */
+        u32 dma_address0      :30;   /* physical/virtual host memory address0 DMA */
+        } dma_0x0;
+
+        struct {
+                u32 DMA_maxpackets    : 8;   /* (remapped) PCI DMA1 Packet Count Interrupt. This variable
+                                                                                is able to be read and written while bit(1) of register
+                                                                                0x00c (remap_enable) is set. This variable represents
+                                                                                the number of packets that will be transmitted to the PCI
+                                                                                host using PCI DMA1 before an interrupt to the PCI is
+                                                                                asserted. This functionality may be enabled using bit(20)
+                                                                                of register 0x208. N=0 disables the IRQ. */
+                u32 dma_addr_size     :24;   /* size of memory buffer in DWORDs (bytesize / 4) for DMA */
+        } dma_0x4_remap;
+
+        struct {
+                u32 dma1timer         : 7;   /* reading PCI DMA1 timer ... when remap_enable is 0 */
+                u32 unused            : 1;
+                u32 dma_addr_size     :24;
+        } dma_0x4_read;
+
+        struct {
+                u32 unused            : 1;
+                u32 dmatimer          : 7;   /* writing PCI DMA1 timer ... when remap_enable is 0 */
+                u32 dma_addr_size     :24;
+        } dma_0x4_write;
+
+        struct {
+                u32 unused            : 2;
+                u32 dma_cur_addr      :30;   /* current physical host memory address pointer for DMA */
+        } dma_0x8;
+
+        struct {
+                u32 dma_1start        : 1;   /* set: data will be delivered to dma_address1, when dma_address0 is full */
+                u32 remap_enable      : 1;   /* remap enable for 0x0x4(7:0) */
+                u32 dma_address1      :30;   /* Physical/virtual address 1 on DMA */
+        } dma_0xc;
+
+/* Two-wire Serial Master and Clock 0x100-0x110 */
+        struct {
+//              u32 slave_transmitter : 1;   /* ???*/
+                u32 chipaddr          : 7;   /* two-line serial address of the target slave */
+                u32 reserved1         : 1;
+                u32 baseaddr          : 8;   /* address of the location of the read/write operation */
+                u32 data1_reg         : 8;   /* first byte in two-line serial read/write operation */
+                u32 working_start     : 1;  /* when doing a write operation this indicator is 0 when ready
+                                                                          * set to 1 when doing a write operation */
+                u32 twoWS_rw          : 1;   /* read/write indicator (1 = read, 0 write) */
+                u32 total_bytes       : 2;   /* number of data bytes in each two-line serial transaction (0 = 1 byte, 11 = 4byte)*/
+                u32 twoWS_port_reg    : 2;   /* port selection: 01 - Front End/Demod, 10 - EEPROM, 11 - Tuner */
+                u32 no_base_addr_ack_error : 1;   /* writing: write-req: frame is produced w/o baseaddr, read-req: read-cycles w/o
+                                                                          * preceding address assignment write frame
+                                                                          * ACK_ERROR = 1 when no ACK from slave in the last transaction */
+                u32 st_done           : 1;   /* indicator for transaction is done */
+        } tw_sm_c_100;
+
+        struct {
+                u32 data2_reg         : 8;   /* 2nd data byte */
+                u32 data3_reg         : 8;   /* 3rd data byte */
+                u32 data4_reg         : 8;   /* 4th data byte */
+                u32 exlicit_stops     : 1;   /* when set, transactions are produced w/o trailing STOP flag, then send isolated STOP flags */
+                u32 force_stop        : 1;   /* isolated stop flag */
+                u32 unused            : 6;
+        } tw_sm_c_104;
+
+/* Clock. The register allows the FCIII to convert an incoming Master clock
+ * (MCLK) signal into a lower frequency clock through the use of a LowCounter
+ * (TLO) and a High- Counter (THI). The time counts for THI and TLO are
+ * measured in MCLK; each count represents 4 MCLK input clock cycles.
+ *
+ * The default output for port #1 is set for Front End Demod communication. (0x108)
+ * The default output for port #2 is set for EEPROM communication. (0x10c)
+ * The default output for port #3 is set for Tuner communication. (0x110)
+ */
+        struct {
+                u32 thi1              : 6;   /* Thi for port #1 (def: 100110b; 38) */
+                u32 reserved1         : 2;
+                u32 tlo1              : 5;   /* Tlo for port #1 (def: 11100b; 28) */
+                u32 reserved2         :19;
+        } tw_sm_c_108;
+
+        struct {
+                u32 thi1              : 6;   /* Thi for port #2 (def: 111001b; 57) */
+                u32 reserved1         : 2;
+                u32 tlo1              : 5;   /* Tlo for port #2 (def: 11100b; 28) */
+                u32 reserved2         :19;
+        } tw_sm_c_10c;
+
+        struct {
+                u32 thi1              : 6;   /* Thi for port #3 (def: 111001b; 57) */
+                u32 reserved1         : 2;
+                u32 tlo1              : 5;   /* Tlo for port #3 (def: 11100b; 28) */
+                u32 reserved2         :19;
+        } tw_sm_c_110;
+
+/* LNB Switch Frequency 0x200
+ * Clock that creates the LNB switch tone. The default is set to have a fixed
+ * low output (not oscillating) to the LNB_CTL line.
+ */
+        struct {
+                u32 LNB_CTLHighCount_sig :15; /* It is the number of pre-scaled clock cycles that will be low. */
+                u32 LNB_CTLLowCount_sig  :15; /* For example, to obtain a 22KHz output given a 45 Mhz Master
+                                                                                Clock signal (MCLK), set PreScalar=01 and LowCounter value to 0x1ff. */
+                u32 LNB_CTLPrescaler_sig : 2; /* pre-scaler divides MCLK: 00 (no division), 01 by 2, 10 by 4, 11 by 12 */
+        } lnb_switch_freq_200;
+
+/* ACPI, Peripheral Reset, LNB Polarity
+ * ACPI power conservation mode, LNB polarity selection (low or high voltage),
+ * and peripheral reset.
+ */
+        struct {
+                u32 ACPI1_sig         : 1;   /* turn of the power of tuner and LNB, not implemented in FCIII */
+                u32 ACPI3_sig         : 1;   /* turn of power of the complete satelite receiver board (except FCIII) */
+                u32 LNB_L_H_sig       : 1;   /* low or high voltage for LNB. (0 = low, 1 = high) */
+                u32 Per_reset_sig     : 1;   /* misc. init reset (default: 1), to reset set to low and back to high */
+                u32 reserved          :20;
+                u32 Rev_N_sig_revision_hi : 4;/* 0xc in case of FCIII */
+                u32 Rev_N_sig_reserved1 : 2;
+                u32 Rev_N_sig_caps    : 1;   /* if 1, FCIII has 32 PID- and MAC-filters and is capable of IP multicast */
+                u32 Rev_N_sig_reserved2 : 1;
+        } misc_204;
+
+/* Control and Status 0x208 to 0x21c */
+/* Gross enable and disable control */
+        struct {
+                u32 Stream1_filter_sig : 1;  /* Stream1 PID filtering */
+                u32 Stream2_filter_sig : 1;  /* Stream2 PID filtering */
+                u32 PCR_filter_sig    : 1;   /* PCR PID filter */
+                u32 PMT_filter_sig    : 1;   /* PMT PID filter */
+
+                u32 EMM_filter_sig    : 1;   /* EMM PID filter */
+                u32 ECM_filter_sig    : 1;   /* ECM PID filter */
+                u32 Null_filter_sig   : 1;   /* Filters null packets, PID=0x1fff. */
+                u32 Mask_filter_sig   : 1;   /* mask PID filter */
+
+                u32 WAN_Enable_sig    : 1;   /* WAN output line through V8 memory space is activated. */
+                u32 WAN_CA_Enable_sig : 1;   /* not in FCIII */
+                u32 CA_Enable_sig     : 1;   /* not in FCIII */
+                u32 SMC_Enable_sig    : 1;   /* CI stream data (CAI) goes directly to the smart card intf (opposed IBI 0x600 or SC-cmd buf). */
+
+                u32 Per_CA_Enable_sig : 1;   /* not in FCIII */
+                u32 Multi2_Enable_sig : 1;   /* ? */
+                u32 MAC_filter_Mode_sig : 1; /* (MAC_filter_enable) Globally enables MAC filters for Net PID filteres. */
+                u32 Rcv_Data_sig      : 1;   /* PID filtering module enable. When this bit is a one, the PID filter will
+                                                                                examine and process packets according to all other (individual) PID
+                                                                                filtering controls. If it a zero, no packet processing of any kind will
+                                                                                take place. All data from the tuner will be thrown away. */
+
+                u32 DMA1_IRQ_Enable_sig : 1; /* When set, a DWORD counter is enabled on PCI DMA1 that asserts the PCI
+                                                                          * interrupt after the specified count for filling the buffer. */
+                u32 DMA1_Timer_Enable_sig : 1; /* When set, a timer is enabled on PCI DMA1 that asserts the PCI interrupt
+                                                                                        after a specified amount of time. */
+                u32 DMA2_IRQ_Enable_sig : 1;   /* same as DMA1_IRQ_Enable_sig but for DMA2 */
+                u32 DMA2_Timer_Enable_sig : 1;   /* same as DMA1_Timer_Enable_sig but for DMA2 */
+
+                u32 DMA1_Size_IRQ_Enable_sig : 1; /* When set, a packet count detector is enabled on PCI DMA1 that asserts the PCI interrupt. */
+                u32 DMA2_Size_IRQ_Enable_sig : 1; /* When set, a packet count detector is enabled on PCI DMA2 that asserts the PCI interrupt. */
+                u32 Mailbox_from_V8_Enable_sig: 1; /* When set, writes to the mailbox register produce an interrupt to the
+                                                                                        PCI host to indicate that mailbox data is available. */
+
+                u32 unused            : 9;
+        } ctrl_208;
+
+/* General status. When a PCI interrupt occurs, this register is read to
+ * discover the reason for the interrupt.
+ */
+        struct {
+                u32 DMA1_IRQ_Status   : 1;   /* When set(1) the DMA1 counter had generated an IRQ. Read Only. */
+                u32 DMA1_Timer_Status : 1;   /* When set(1) the DMA1 timer had generated an IRQ. Read Only. */
+                u32 DMA2_IRQ_Status   : 1;   /* When set(1) the DMA2 counter had generated an IRQ. Read Only. */
+                u32 DMA2_Timer_Status : 1;   /* When set(1) the DMA2 timer had generated an IRQ. Read Only. */
+                u32 DMA1_Size_IRQ_Status : 1; /* (Read only). This register is read after an interrupt to */
+                u32 DMA2_Size_IRQ_Status : 1; /* find out why we had an IRQ. Reading this register will clear this bit. Packet count*/
+                u32 Mailbox_from_V8_Status_sig: 1; /* Same as above. Reading this register will clear this bit. */
+                u32 Data_receiver_error : 1; /* 1 indicate an error in the receiver Front End (Tuner module) */
+                u32 Continuity_error_flag : 1;   /* 1 indicates a continuity error in the TS stream. */
+                u32 LLC_SNAP_FLAG_set : 1;   /* 1 indicates that the LCC_SNAP_FLAG was set. */
+                u32 Transport_Error   : 1;   /*  When set indicates that an unexpected packet was received. */
+                u32 reserved          :21;
+        } irq_20c;
+
+
+/* Software reset register */
+        struct {
+                u32 reset_blocks      : 8;   /* Enabled when Block_reset_enable = 0xB2 and 0x208 bits 15:8 = 0x00.
+                                                                                Each bit location represents a 0x100 block of registers. Writing
+                                                                                a one in a bit location resets that block of registers and the logic
+                                                                                that it controls. */
+                u32 Block_reset_enable : 8;  /* This variable is set to 0xB2 when the register is written. */
+                u32 Special_controls  :16;   /* Asserts Reset_V8 => 0xC258; Turns on pci encryption => 0xC25A;
+                                                                                Turns off pci encryption => 0xC259 Note: pci_encryption default
+                                                                                at power-up is ON. */
+        } sw_reset_210;
+
+        struct {
+                u32 vuart_oe_sig      : 1;   /* When clear, the V8 processor has sole control of the serial UART
+                                                                                (RS-232 Smart Card interface). When set, the IBI interface
+                                                                                defined by register 0x600 controls the serial UART. */
+                u32 v2WS_oe_sig       : 1;   /* When clear, the V8 processor has direct control of the Two-line
+                                                                                Serial Master EEPROM target. When set, the Two-line Serial Master
+                                                                                EEPROM target interface is controlled by IBI register 0x100. */
+                u32 halt_V8_sig       : 1;   /* When set, contiguous wait states are applied to the V8-space
+                                                                                bus masters. Once this signal is cleared, normal V8-space
+                                                                                operations resume. */
+                u32 section_pkg_enable_sig: 1; /* When set, this signal enables the front end translation circuitry
+                                                                                  to process section packed transport streams. */
+                u32 s2p_sel_sig       : 1;   /* Serial to parallel conversion. When set, polarized transport data
+                                                                                within the FlexCop3 front end circuitry is converted from a serial
+                                                                                stream into parallel data before downstream processing otherwise
+                                                                                interprets the data. */
+                u32 unused1           : 3;
+                u32 polarity_PS_CLK_sig: 1;  /* This signal is used to invert the input polarity of the tranport
+                                                                                stream CLOCK signal before any processing occurs on the transport
+                                                                                stream within FlexCop3. */
+                u32 polarity_PS_VALID_sig: 1; /* This signal is used to invert the input polarity of the tranport
+                                                                                stream VALID signal before any processing occurs on the transport
+                                                                                stream within FlexCop3. */
+                u32 polarity_PS_SYNC_sig: 1; /* This signal is used to invert the input polarity of the tranport
+                                                                                stream SYNC signal before any processing occurs on the transport
+                                                                                stream within FlexCop3. */
+                u32 polarity_PS_ERR_sig: 1;  /* This signal is used to invert the input polarity of the tranport
+                                                                                stream ERROR signal before any processing occurs on the transport
+                                                                                stream within FlexCop3. */
+                u32 unused2           :20;
+        } misc_214;
+
+/* Mailbox from V8 to host */
+        struct {
+                u32 Mailbox_from_V8   :32;   /* When this register is written by either the V8 processor or by an
+                                                                                end host, an interrupt is generated to the PCI host to indicate
+                                                                                that mailbox data is available. Reading register 20c will clear
+                                                                                the IRQ. */
+        } mbox_v8_to_host_218;
+
+/* Mailbox from host to v8 Mailbox_to_V8
+ * Mailbox_to_V8 mailbox storage register
+ * used to send messages from PCI to V8. Writing to this register will send an
+ * IRQ to the V8. Then it can read the data from here. Reading this register
+ * will clear the IRQ. If the V8 is halted and bit 31 of this register is set,
+ * then this register is used instead as a direct interface to access the
+ * V8space memory.
+ */
+        struct {
+                u32 sysramaccess_data : 8;   /* Data byte written or read from the specified address in V8 SysRAM. */
+                u32 sysramaccess_addr :15;   /* 15 bit address used to access V8 Sys-RAM. */
+                u32 unused            : 7;
+                u32 sysramaccess_write: 1;   /* Write flag used to latch data into the V8 SysRAM. */
+                u32 sysramaccess_busmuster: 1; /* Setting this bit when the V8 is halted at 0x214 Bit(2) allows
+                                                                                  this IBI register interface to directly drive the V8-space memory. */
+        } mbox_host_to_v8_21c;
+
+
+/* PIDs, Translation Bit, SMC Filter Select 0x300 to 0x31c */
+        struct {
+                u32 Stream1_PID       :13;   /* Primary use is receiving Net data, so these 13 bits normally
+                                                                                hold the PID value for the desired network stream. */
+                u32 Stream1_trans     : 1;   /* When set, Net translation will take place for Net data ferried in TS packets. */
+                u32 MAC_Multicast_filter : 1;   /* When clear, multicast MAC filtering is not allowed for Stream1 and PID_n filters. */
+                u32 debug_flag_pid_saved : 1;
+                u32 Stream2_PID       :13;   /* 13 bits for Stream 2 PID filter value. General use. */
+                u32 Stream2_trans     : 1;   /* When set Tables/CAI translation will take place for the data ferried in
+                                                                                Stream2_PID TS packets. */
+                u32 debug_flag_write_status00 : 1;
+                u32 debug_fifo_problem : 1;
+        } pid_filter_300;
+
+        struct {
+                u32 PCR_PID           :13;   /* PCR stream PID filter value. Primary use is Program Clock Reference stream filtering. */
+                u32 PCR_trans         : 1;   /* When set, Tables/CAI translation will take place for these packets. */
+                u32 debug_overrun3    : 1;
+                u32 debug_overrun2    : 1;
+                u32 PMT_PID           :13;   /* stream PID filter value. Primary use is Program Management Table segment filtering. */
+                u32 PMT_trans         : 1;   /* When set, Tables/CAI translation will take place for these packets. */
+                u32 reserved          : 2;
+        } pid_filter_304;
+
+        struct {
+                u32 EMM_PID           :13;   /* EMM PID filter value. Primary use is Entitlement Management Messaging for
+                                                                                conditional access-related data. */
+                u32 EMM_trans         : 1;   /* When set, Tables/CAI translation will take place for these packets. */
+                u32 EMM_filter_4      : 1;   /* When set will pass only EMM data possessing the same ID code as the
+                                                                                first four bytes (32 bits) of the end-user s 6-byte Smart Card ID number Select */
+                u32 EMM_filter_6      : 1;   /* When set will pass only EMM data possessing the same 6-byte code as the end-users
+                                                                                complete 6-byte Smart Card ID number. */
+                u32 ECM_PID           :13;   /* ECM PID filter value. Primary use is Entitlement Control Messaging for conditional
+                                                                                access-related data. */
+                u32 ECM_trans         : 1;   /* When set, Tables/CAI translation will take place for these packets. */
+                u32 reserved          : 2;
+        } pid_filter_308;
+
+        struct {
+                u32 Group_PID     :13;   /* PID value for group filtering. */
+                u32 Group_trans   : 1;   /* When set, Tables/CAI translation will take place for these packets. */
+                u32 unused1       : 2;
+                u32 Group_mask    :13;   /* Mask value used in logical "and" equation that defines group filtering */
+                u32 unused2       : 3;
+        } pid_filter_30c_ext_ind_0_7;
+
+        struct {
+                u32 net_master_read :17;
+                u32 unused        :15;
+        } pid_filter_30c_ext_ind_1;
+
+        struct {
+                u32 net_master_write :17;
+                u32 unused        :15;
+        } pid_filter_30c_ext_ind_2;
+
+        struct {
+                u32 next_net_master_write :17;
+                u32 unused        :15;
+        } pid_filter_30c_ext_ind_3;
+
+        struct {
+                u32 unused1       : 1;
+                u32 state_write   :10;
+                u32 reserved1     : 6;   /* default: 000100 */
+                u32 stack_read    :10;
+                u32 reserved2     : 5;   /* default: 00100 */
+        } pid_filter_30c_ext_ind_4;
+
+        struct {
+                u32 stack_cnt     :10;
+                u32 unused        :22;
+        } pid_filter_30c_ext_ind_5;
+
+        struct {
+                u32 pid_fsm_save_reg0 : 2;
+                u32 pid_fsm_save_reg1 : 2;
+                u32 pid_fsm_save_reg2 : 2;
+                u32 pid_fsm_save_reg3 : 2;
+                u32 pid_fsm_save_reg4 : 2;
+                u32 pid_fsm_save_reg300 : 2;
+                u32 write_status1 : 2;
+                u32 write_status4 : 2;
+                u32 data_size_reg :12;
+                u32 unused        : 4;
+        } pid_filter_30c_ext_ind_6;
+
+        struct {
+                u32 index_reg         : 5;   /* (Index pointer) Points at an internal PIDn register. A binary code
+                                                                                representing one of 32 internal PIDn registers as well as its
+                                                                                corresponding internal MAC_lown register. */
+                u32 extra_index_reg   : 3;   /* This vector is used to select between sets of debug signals routed to register 0x30c. */
+                u32 AB_select         : 1;   /* Used in conjunction with 0x31c. read/write to the MAC_highA or MAC_highB register
+                                                                                0=MAC_highB register, 1=MAC_highA */
+                u32 pass_alltables    : 1;   /* 1=Net packets are not filtered against the Network Table ID found in register 0x400.
+                                                                                All types of networks (DVB, ATSC, ISDB) are passed. */
+                u32 unused            :22;
+        } index_reg_310;
+
+        struct {
+                u32 PID               :13;   /* PID value */
+                u32 PID_trans         : 1;   /* translation will take place for packets filtered */
+                u32 PID_enable_bit    : 1;   /* When set this PID filter is enabled */
+                u32 reserved          :17;
+        } pid_n_reg_314;
+
+        struct {
+                u32 A4_byte           : 8;
+                u32 A5_byte           : 8;
+                u32 A6_byte           : 8;
+                u32 Enable_bit        : 1;   /* enabled (1) or disabled (1) */
+                u32 HighAB_bit        : 1;   /* use MAC_highA (1) or MAC_highB (0) as MSB */
+                u32 reserved          : 6;
+        } mac_low_reg_318;
+
+        struct {
+                u32 A1_byte           : 8;
+                u32 A2_byte           : 8;
+                u32 A3_byte           : 8;
+                u32 reserved          : 8;
+        } mac_high_reg_31c;
+
+/* Table, SMCID,MACDestination Filters 0x400 to 0x41c */
+        struct {
+                u32 reserved          :16;
+#define fc_data_Tag_ID_DVB  0x3e
+#define fc_data_Tag_ID_ATSC 0x3f
+#define fc_data_Tag_ID_IDSB 0x8b
+                u32 data_Tag_ID       :16;
+        } data_tag_400;
+
+        struct {
+                u32 Card_IDbyte6      : 8;
+                u32 Card_IDbyte5      : 8;
+                u32 Card_IDbyte4      : 8;
+                u32 Card_IDbyte3      : 8;
+        } card_id_408;
+
+        struct {
+                u32 Card_IDbyte2      : 8;
+                u32 Card_IDbyte1      : 8;
+        } card_id_40c;
+
+        /* holding the unique mac address of the receiver which houses the FlexCopIII */
+        struct {
+                u32 MAC1              : 8;
+                u32 MAC2              : 8;
+                u32 MAC3              : 8;
+                u32 MAC6              : 8;
+        } mac_address_418;
+
+        struct {
+                u32 MAC7              : 8;
+                u32 MAC8              : 8;
+                u32 reserved          : 16;
+        } mac_address_41c;
+
+        struct {
+                u32 transmitter_data_byte : 8;
+                u32 ReceiveDataReady  : 1;
+                u32 ReceiveByteFrameError: 1;
+                u32 txbuffempty       : 1;
+                u32 reserved          :21;
+        } ci_600;
+
+        struct {
+                u32 pi_d              : 8;
+                u32 pi_ha             :20;
+                u32 pi_rw             : 1;
+                u32 pi_component_reg  : 3;
+        } pi_604;
+
+        struct {
+                u32 serialReset       : 1;
+                u32 oncecycle_read    : 1;
+                u32 Timer_Read_req    : 1;
+                u32 Timer_Load_req    : 1;
+                u32 timer_data        : 7;
+                u32 unused            : 1; /* ??? not mentioned in data book */
+                u32 Timer_addr        : 5;
+                u32 reserved          : 3;
+                u32 pcmcia_a_mod_pwr_n : 1;
+                u32 pcmcia_b_mod_pwr_n : 1;
+                u32 config_Done_stat  : 1;
+                u32 config_Init_stat  : 1;
+                u32 config_Prog_n     : 1;
+                u32 config_wr_n       : 1;
+                u32 config_cs_n       : 1;
+                u32 config_cclk       : 1;
+                u32 pi_CiMax_IRQ_n    : 1;
+                u32 pi_timeout_status : 1;
+                u32 pi_wait_n         : 1;
+                u32 pi_busy_n         : 1;
+        } pi_608;
+
+        struct {
+                u32 PID               :13;
+                u32 key_enable        : 1;
+#define fc_key_code_default 0x1
+#define fc_key_code_even    0x2
+#define fc_key_code_odd     0x3
+                u32 key_code          : 2;
+                u32 key_array_col     : 3;
+                u32 key_array_row     : 5;
+                u32 dvb_en            : 1; /* 0=TS bypasses the Descrambler */
+                u32 rw_flag           : 1;
+                u32 reserved          : 6;
+        } dvb_reg_60c;
+
+/* SRAM and Output Destination 0x700 to 0x714 */
+        struct {
+                u32 sram_addr         :15;
+                u32 sram_rw           : 1;   /* 0=write, 1=read */
+                u32 sram_data         : 8;
+                u32 sc_xfer_bit       : 1;
+                u32 reserved1         : 3;
+                u32 oe_pin_reg        : 1;
+                u32 ce_pin_reg        : 1;
+                u32 reserved2         : 1;
+                u32 start_sram_ibi    : 1;
+        } sram_ctrl_reg_700;
+
+        struct {
+                u32 net_addr_read     :16;
+                u32 net_addr_write    :16;
+        } net_buf_reg_704;
+
+        struct {
+                u32 cai_read          :11;
+                u32 reserved1         : 5;
+                u32 cai_write         :11;
+                u32 reserved2         : 6;
+                u32 cai_cnt           : 4;
+        } cai_buf_reg_708;
+
+        struct {
+                u32 cao_read          :11;
+                u32 reserved1         : 5;
+                u32 cap_write         :11;
+                u32 reserved2         : 6;
+                u32 cao_cnt           : 4;
+        } cao_buf_reg_70c;
+
+        struct {
+                u32 media_read        :11;
+                u32 reserved1         : 5;
+                u32 media_write       :11;
+                u32 reserved2         : 6;
+                u32 media_cnt         : 4;
+        } media_buf_reg_710;
+
+        struct {
+                u32 NET_Dest          : 2;
+                u32 CAI_Dest          : 2;
+                u32 CAO_Dest          : 2;
+                u32 MEDIA_Dest        : 2;
+                u32 net_ovflow_error  : 1;
+                u32 media_ovflow_error : 1;
+                u32 cai_ovflow_error  : 1;
+                u32 cao_ovflow_error  : 1;
+                u32 ctrl_usb_wan      : 1;
+                u32 ctrl_sramdma      : 1;
+                u32 ctrl_maximumfill  : 1;
+                u32 reserved          :17;
+        } sram_dest_reg_714;
+
+        struct {
+                u32 net_cnt           :12;
+                u32 reserved1         : 4;
+                u32 net_addr_read     : 1;
+                u32 reserved2         : 3;
+                u32 net_addr_write    : 1;
+                u32 reserved3         :11;
+        } net_buf_reg_718;
+
+        struct {
+                u32 wan_speed_sig     : 2;
+                u32 reserved1         : 6;
+                u32 wan_wait_state    : 8;
+                u32 sram_chip         : 2;
+                u32 sram_memmap       : 2;
+                u32 reserved2         : 4;
+                u32 wan_pkt_frame     : 4;
+                u32 reserved3         : 4;
+        } wan_ctrl_reg_71c;
+} flexcop_ibi_value;
+
+extern flexcop_ibi_value ibi_zero;
+
+typedef enum {
+        FC_I2C_PORT_DEMOD  = 1,
+        FC_I2C_PORT_EEPROM = 2,
+        FC_I2C_PORT_TUNER  = 3,
+} flexcop_i2c_port_t;
+
+typedef enum {
+        FC_WRITE = 0,
+        FC_READ  = 1,
+} flexcop_access_op_t;
+
+typedef enum {
+        FC_SRAM_DEST_NET   = 1,
+        FC_SRAM_DEST_CAI   = 2,
+        FC_SRAM_DEST_CAO   = 4,
+        FC_SRAM_DEST_MEDIA = 8
+} flexcop_sram_dest_t;
+
+typedef enum {
+        FC_SRAM_DEST_TARGET_WAN_USB = 0,
+        FC_SRAM_DEST_TARGET_DMA1    = 1,
+        FC_SRAM_DEST_TARGET_DMA2    = 2,
+        FC_SRAM_DEST_TARGET_FC3_CA  = 3
+} flexcop_sram_dest_target_t;
+
+typedef enum {
+        FC_SRAM_2_32KB  = 0, /*  64KB */
+        FC_SRAM_1_32KB  = 1, /*  32KB - default fow FCII */
+        FC_SRAM_1_128KB = 2, /* 128KB */
+        FC_SRAM_1_48KB  = 3, /*  48KB - default for FCIII */
+} flexcop_sram_type_t;
+
+typedef enum {
+        FC_WAN_SPEED_4MBITS  = 0,
+        FC_WAN_SPEED_8MBITS  = 1,
+        FC_WAN_SPEED_12MBITS = 2,
+        FC_WAN_SPEED_16MBITS = 3,
+} flexcop_wan_speed_t;
+
+typedef enum {
+        FC_DMA_1 = 1,
+        FC_DMA_2 = 2,
+} flexcop_dma_index_t;
+
+typedef enum {
+        FC_DMA_SUBADDR_0 = 1,
+        FC_DMA_SUBADDR_1 = 2,
+} flexcop_dma_addr_index_t;
+
+/* names of the particular registers */
+typedef enum {
+        dma1_000            = 0x000,
+        dma1_004            = 0x004,
+        dma1_008            = 0x008,
+        dma1_00c            = 0x00c,
+        dma2_010            = 0x010,
+        dma2_014            = 0x014,
+        dma2_018            = 0x018,
+        dma2_01c            = 0x01c,
+
+        tw_sm_c_100         = 0x100,
+        tw_sm_c_104         = 0x104,
+        tw_sm_c_108         = 0x108,
+        tw_sm_c_10c         = 0x10c,
+        tw_sm_c_110         = 0x110,
+
+        lnb_switch_freq_200 = 0x200,
+        misc_204            = 0x204,
+        ctrl_208            = 0x208,
+        irq_20c             = 0x20c,
+        sw_reset_210        = 0x210,
+        misc_214            = 0x214,
+        mbox_v8_to_host_218 = 0x218,
+        mbox_host_to_v8_21c = 0x21c,
+
+        pid_filter_300      = 0x300,
+        pid_filter_304      = 0x304,
+        pid_filter_308      = 0x308,
+        pid_filter_30c      = 0x30c,
+        index_reg_310       = 0x310,
+        pid_n_reg_314       = 0x314,
+        mac_low_reg_318     = 0x318,
+        mac_high_reg_31c    = 0x31c,
+
+        data_tag_400        = 0x400,
+        card_id_408         = 0x408,
+        card_id_40c         = 0x40c,
+        mac_address_418     = 0x418,
+        mac_address_41c     = 0x41c,
+
+        ci_600              = 0x600,
+        pi_604              = 0x604,
+        pi_608              = 0x608,
+        dvb_reg_60c         = 0x60c,
+
+        sram_ctrl_reg_700   = 0x700,
+        net_buf_reg_704     = 0x704,
+        cai_buf_reg_708     = 0x708,
+        cao_buf_reg_70c     = 0x70c,
+        media_buf_reg_710   = 0x710,
+        sram_dest_reg_714   = 0x714,
+        net_buf_reg_718     = 0x718,
+        wan_ctrl_reg_71c    = 0x71c,
+} flexcop_ibi_register;
+
+#define flexcop_set_ibi_value(reg,attr,val) { \
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,reg); \
+        v.reg.attr = val; \
+        fc->write_ibi_reg(fc,reg,v); \
+}
+
+#endif
diff --git a/drivers/media/dvb/b2c2/flexcop-sram.c b/drivers/media/dvb/b2c2/flexcop-sram.c
new file mode 100644
index 000000000000..01570ec80962
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-sram.c
@@ -0,0 +1,403 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-sram.c - functions for controlling the SRAM.
+ *
+ * see flexcop.c for copyright information.
+ */
+#include "flexcop.h"
+
+static void flexcop_sram_set_chip (struct flexcop_device *fc, flexcop_sram_type_t type)
+{
+        flexcop_set_ibi_value(wan_ctrl_reg_71c,sram_chip,type);
+}
+
+int flexcop_sram_init(struct flexcop_device *fc)
+{
+        switch (fc->rev) {
+                case FLEXCOP_II:
+                case FLEXCOP_IIB:
+                        flexcop_sram_set_chip(fc,FC_SRAM_1_32KB);
+                        break;
+                case FLEXCOP_III:
+                        flexcop_sram_set_chip(fc,FC_SRAM_1_48KB);
+                        break;
+                default:
+                        return -EINVAL;
+        }
+        return 0;
+}
+
+int flexcop_sram_set_dest(struct flexcop_device *fc, flexcop_sram_dest_t dest, flexcop_sram_dest_target_t target)
+{
+        flexcop_ibi_value v;
+
+        v = fc->read_ibi_reg(fc,sram_dest_reg_714);
+
+        if (fc->rev != FLEXCOP_III && target == FC_SRAM_DEST_TARGET_FC3_CA) {
+                err("SRAM destination target to available on FlexCopII(b)\n");
+                return -EINVAL;
+        }
+
+        deb_sram("sram dest: %x target: %x\n",dest, target);
+
+        if (dest & FC_SRAM_DEST_NET)
+                v.sram_dest_reg_714.NET_Dest = target;
+        if (dest & FC_SRAM_DEST_CAI)
+                v.sram_dest_reg_714.CAI_Dest = target;
+        if (dest & FC_SRAM_DEST_CAO)
+                v.sram_dest_reg_714.CAO_Dest = target;
+        if (dest & FC_SRAM_DEST_MEDIA)
+                v.sram_dest_reg_714.MEDIA_Dest = target;
+
+        fc->write_ibi_reg(fc,sram_dest_reg_714,v);
+        udelay(1000); /* TODO delay really necessary */
+
+        return 0;
+}
+EXPORT_SYMBOL(flexcop_sram_set_dest);
+
+void flexcop_wan_set_speed(struct flexcop_device *fc, flexcop_wan_speed_t s)
+{
+        flexcop_set_ibi_value(wan_ctrl_reg_71c,wan_speed_sig,s);
+}
+EXPORT_SYMBOL(flexcop_wan_set_speed);
+
+void flexcop_sram_ctrl(struct flexcop_device *fc, int usb_wan, int sramdma, int maximumfill)
+{
+        flexcop_ibi_value v = fc->read_ibi_reg(fc,sram_dest_reg_714);
+        v.sram_dest_reg_714.ctrl_usb_wan = usb_wan;
+        v.sram_dest_reg_714.ctrl_sramdma = sramdma;
+        v.sram_dest_reg_714.ctrl_maximumfill = maximumfill;
+        fc->write_ibi_reg(fc,sram_dest_reg_714,v);
+}
+EXPORT_SYMBOL(flexcop_sram_ctrl);
+
+#if 0
+static void flexcop_sram_write(struct adapter *adapter, u32 bank, u32 addr, u8 *buf, u32 len)
+{
+        int i, retries;
+        u32 command;
+
+        for (i = 0; i < len; i++) {
+                command = bank | addr | 0x04000000 | (*buf << 0x10);
+
+                retries = 2;
+
+                while (((read_reg_dw(adapter, 0x700) & 0x80000000) != 0) && (retries > 0)) {
+                        mdelay(1);
+                        retries--;
+                };
+
+                if (retries == 0)
+                        printk("%s: SRAM timeout\n", __FUNCTION__);
+
+                write_reg_dw(adapter, 0x700, command);
+
+                buf++;
+                addr++;
+        }
+}
+
+static void flex_sram_read(struct adapter *adapter, u32 bank, u32 addr, u8 *buf, u32 len)
+{
+        int i, retries;
+        u32 command, value;
+
+        for (i = 0; i < len; i++) {
+                command = bank | addr | 0x04008000;
+
+                retries = 10000;
+
+                while (((read_reg_dw(adapter, 0x700) & 0x80000000) != 0) && (retries > 0)) {
+                        mdelay(1);
+                        retries--;
+                };
+
+                if (retries == 0)
+                        printk("%s: SRAM timeout\n", __FUNCTION__);
+
+                write_reg_dw(adapter, 0x700, command);
+
+                retries = 10000;
+
+                while (((read_reg_dw(adapter, 0x700) & 0x80000000) != 0) && (retries > 0)) {
+                        mdelay(1);
+                        retries--;
+                };
+
+                if (retries == 0)
+                        printk("%s: SRAM timeout\n", __FUNCTION__);
+
+                value = read_reg_dw(adapter, 0x700) >> 0x10;
+
+                *buf = (value & 0xff);
+
+                addr++;
+                buf++;
+        }
+}
+
+static void sram_write_chunk(struct adapter *adapter, u32 addr, u8 *buf, u16 len)
+{
+        u32 bank;
+
+        bank = 0;
+
+        if (adapter->dw_sram_type == 0x20000) {
+                bank = (addr & 0x18000) << 0x0d;
+        }
+
+        if (adapter->dw_sram_type == 0x00000) {
+                if ((addr >> 0x0f) == 0)
+                        bank = 0x20000000;
+                else
+                        bank = 0x10000000;
+        }
+
+        flex_sram_write(adapter, bank, addr & 0x7fff, buf, len);
+}
+
+static void sram_read_chunk(struct adapter *adapter, u32 addr, u8 *buf, u16 len)
+{
+        u32 bank;
+
+        bank = 0;
+
+        if (adapter->dw_sram_type == 0x20000) {
+                bank = (addr & 0x18000) << 0x0d;
+        }
+
+        if (adapter->dw_sram_type == 0x00000) {
+                if ((addr >> 0x0f) == 0)
+                        bank = 0x20000000;
+                else
+                        bank = 0x10000000;
+        }
+
+        flex_sram_read(adapter, bank, addr & 0x7fff, buf, len);
+}
+
+static void sram_read(struct adapter *adapter, u32 addr, u8 *buf, u32 len)
+{
+        u32 length;
+
+        while (len != 0) {
+                length = len;
+
+                // check if the address range belongs to the same
+                // 32K memory chip. If not, the data is read from
+                // one chip at a time.
+                if ((addr >> 0x0f) != ((addr + len - 1) >> 0x0f)) {
+                        length = (((addr >> 0x0f) + 1) << 0x0f) - addr;
+                }
+
+                sram_read_chunk(adapter, addr, buf, length);
+
+                addr = addr + length;
+                buf = buf + length;
+                len = len - length;
+        }
+}
+
+static void sram_write(struct adapter *adapter, u32 addr, u8 *buf, u32 len)
+{
+        u32 length;
+
+        while (len != 0) {
+                length = len;
+
+                // check if the address range belongs to the same
+                // 32K memory chip. If not, the data is written to
+                // one chip at a time.
+                if ((addr >> 0x0f) != ((addr + len - 1) >> 0x0f)) {
+                        length = (((addr >> 0x0f) + 1) << 0x0f) - addr;
+                }
+
+                sram_write_chunk(adapter, addr, buf, length);
+
+                addr = addr + length;
+                buf = buf + length;
+                len = len - length;
+        }
+}
+
+static void sram_set_size(struct adapter *adapter, u32 mask)
+{
+        write_reg_dw(adapter, 0x71c, (mask | (~0x30000 & read_reg_dw(adapter, 0x71c))));
+}
+
+static void sram_init(struct adapter *adapter)
+{
+        u32 tmp;
+
+        tmp = read_reg_dw(adapter, 0x71c);
+
+        write_reg_dw(adapter, 0x71c, 1);
+
+        if (read_reg_dw(adapter, 0x71c) != 0) {
+                write_reg_dw(adapter, 0x71c, tmp);
+
+                adapter->dw_sram_type = tmp & 0x30000;
+
+                ddprintk("%s: dw_sram_type = %x\n", __FUNCTION__, adapter->dw_sram_type);
+
+        } else {
+
+                adapter->dw_sram_type = 0x10000;
+
+                ddprintk("%s: dw_sram_type = %x\n", __FUNCTION__, adapter->dw_sram_type);
+        }
+
+        /* return value is never used? */
+/*      return adapter->dw_sram_type; */
+}
+
+static int sram_test_location(struct adapter *adapter, u32 mask, u32 addr)
+{
+        u8 tmp1, tmp2;
+
+        dprintk("%s: mask = %x, addr = %x\n", __FUNCTION__, mask, addr);
+
+        sram_set_size(adapter, mask);
+        sram_init(adapter);
+
+        tmp2 = 0xa5;
+        tmp1 = 0x4f;
+
+        sram_write(adapter, addr, &tmp2, 1);
+        sram_write(adapter, addr + 4, &tmp1, 1);
+
+        tmp2 = 0;
+
+        mdelay(20);
+
+        sram_read(adapter, addr, &tmp2, 1);
+        sram_read(adapter, addr, &tmp2, 1);
+
+        dprintk("%s: wrote 0xa5, read 0x%2x\n", __FUNCTION__, tmp2);
+
+        if (tmp2 != 0xa5)
+                return 0;
+
+        tmp2 = 0x5a;
+        tmp1 = 0xf4;
+
+        sram_write(adapter, addr, &tmp2, 1);
+        sram_write(adapter, addr + 4, &tmp1, 1);
+
+        tmp2 = 0;
+
+        mdelay(20);
+
+        sram_read(adapter, addr, &tmp2, 1);
+        sram_read(adapter, addr, &tmp2, 1);
+
+        dprintk("%s: wrote 0x5a, read 0x%2x\n", __FUNCTION__, tmp2);
+
+        if (tmp2 != 0x5a)
+                return 0;
+
+        return 1;
+}
+
+static u32 sram_length(struct adapter *adapter)
+{
+        if (adapter->dw_sram_type == 0x10000)
+                return 32768;   //  32K
+        if (adapter->dw_sram_type == 0x00000)
+                return 65536;   //  64K
+        if (adapter->dw_sram_type == 0x20000)
+                return 131072;  // 128K
+
+        return 32768;           // 32K
+}
+
+/* FlexcopII can work with 32K, 64K or 128K of external SRAM memory.
+    - for 128K there are 4x32K chips at bank 0,1,2,3.
+    - for  64K there are 2x32K chips at bank 1,2.
+    - for  32K there is one 32K chip at bank 0.
+
+   FlexCop works only with one bank at a time. The bank is selected
+   by bits 28-29 of the 0x700 register.
+
+   bank 0 covers addresses 0x00000-0x07fff
+   bank 1 covers addresses 0x08000-0x0ffff
+   bank 2 covers addresses 0x10000-0x17fff
+   bank 3 covers addresses 0x18000-0x1ffff
+*/
+
+static int flexcop_sram_detect(struct flexcop_device *fc)
+{
+        flexcop_ibi_value r208,r71c_0,vr71c_1;
+
+        r208 = fc->read_ibi_reg(fc, ctrl_208);
+        fc->write_ibi_reg(fc, ctrl_208, ibi_zero);
+
+        r71c_0 = fc->read_ibi_reg(fc, wan_ctrl_reg_71c);
+
+        write_reg_dw(adapter, 0x71c, 1);
+
+        tmp3 = read_reg_dw(adapter, 0x71c);
+
+        dprintk("%s: tmp3 = %x\n", __FUNCTION__, tmp3);
+
+        write_reg_dw(adapter, 0x71c, tmp2);
+
+        // check for internal SRAM ???
+        tmp3--;
+        if (tmp3 != 0) {
+                sram_set_size(adapter, 0x10000);
+                sram_init(adapter);
+                write_reg_dw(adapter, 0x208, tmp);
+
+                dprintk("%s: sram size = 32K\n", __FUNCTION__);
+
+                return 32;
+        }
+
+        if (sram_test_location(adapter, 0x20000, 0x18000) != 0) {
+                sram_set_size(adapter, 0x20000);
+                sram_init(adapter);
+                write_reg_dw(adapter, 0x208, tmp);
+
+                dprintk("%s: sram size = 128K\n", __FUNCTION__);
+
+                return 128;
+        }
+
+        if (sram_test_location(adapter, 0x00000, 0x10000) != 0) {
+                sram_set_size(adapter, 0x00000);
+                sram_init(adapter);
+                write_reg_dw(adapter, 0x208, tmp);
+
+                dprintk("%s: sram size = 64K\n", __FUNCTION__);
+
+                return 64;
+        }
+
+        if (sram_test_location(adapter, 0x10000, 0x00000) != 0) {
+                sram_set_size(adapter, 0x10000);
+                sram_init(adapter);
+                write_reg_dw(adapter, 0x208, tmp);
+
+                dprintk("%s: sram size = 32K\n", __FUNCTION__);
+
+                return 32;
+        }
+
+        sram_set_size(adapter, 0x10000);
+        sram_init(adapter);
+        write_reg_dw(adapter, 0x208, tmp);
+
+        dprintk("%s: SRAM detection failed. Set to 32K \n", __FUNCTION__);
+
+        return 0;
+}
+
+static void sll_detect_sram_size(struct adapter *adapter)
+{
+        sram_detect_for_flex2(adapter);
+}
+
+#endif
diff --git a/drivers/media/dvb/b2c2/flexcop-usb.c b/drivers/media/dvb/b2c2/flexcop-usb.c
new file mode 100644
index 000000000000..0113449abd15
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-usb.c
@@ -0,0 +1,577 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop-usb.c - covers the USB part.
+ *
+ * see flexcop.c for copyright information.
+ */
+
+#define FC_LOG_PREFIX "flexcop_usb"
+#include "flexcop-usb.h"
+#include "flexcop-common.h"
+
+/* Version information */
+#define DRIVER_VERSION "0.1"
+#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV USB Driver"
+#define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
+
+/* debug */
+#ifdef CONFIG_DVB_B2C2_FLEXCOP_DEBUG
+#define dprintk(level,args...) \
+            do { if ((debug & level)) { printk(args); } } while (0)
+#define debug_dump(b,l,method) {\
+        int i; \
+        for (i = 0; i < l; i++) method("%02x ", b[i]); \
+        method("\n");\
+}
+
+#define DEBSTATUS ""
+#else
+#define dprintk(level,args...)
+#define debug_dump(b,l,method)
+#define DEBSTATUS " (debugging is not enabled)"
+#endif
+
+static int debug;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "set debugging level (1=info,ts=2,ctrl=4,i2c=8,v8mem=16 (or-able))." DEBSTATUS);
+#undef DEBSTATUS
+
+#define deb_info(args...) dprintk(0x01,args)
+#define deb_ts(args...)   dprintk(0x02,args)
+#define deb_ctrl(args...) dprintk(0x04,args)
+#define deb_i2c(args...)  dprintk(0x08,args)
+#define deb_v8(args...)   dprintk(0x10,args)
+
+/* JLP 111700: we will include the 1 bit gap between the upper and lower 3 bits
+ * in the IBI address, to make the V8 code simpler.
+ * PCI ADDRESS FORMAT: 0x71C -> 0000 0111 0001 1100 (these are the six bits used)
+ *                  in general: 0000 0HHH 000L LL00
+ * IBI ADDRESS FORMAT:                    RHHH BLLL
+ *
+ * where R is the read(1)/write(0) bit, B is the busy bit
+ * and HHH and LLL are the two sets of three bits from the PCI address.
+ */
+#define B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(usPCI) (u8) (((usPCI >> 2) & 0x07) + ((usPCI >> 4) & 0x70))
+#define B2C2_FLEX_INTERNALADDR_TO_PCIOFFSET(ucAddr) (u16) (((ucAddr & 0x07) << 2) + ((ucAddr & 0x70) << 4))
+
+/*
+ * DKT 020228
+ * - forget about this VENDOR_BUFFER_SIZE, read and write register
+ *   deal with DWORD or 4 bytes, that should be should from now on
+ * - from now on, we don't support anything older than firm 1.00
+ *   I eliminated the write register as a 2 trip of writing hi word and lo word
+ *   and force this to write only 4 bytes at a time.
+ *   NOTE: this should work with all the firmware from 1.00 and newer
+ */
+static int flexcop_usb_readwrite_dw(struct flexcop_device *fc, u16 wRegOffsPCI, u32 *val, u8 read)
+{
+        struct flexcop_usb *fc_usb = fc->bus_specific;
+        u8 request = read ? B2C2_USB_READ_REG : B2C2_USB_WRITE_REG;
+        u8 request_type = (read ? USB_DIR_IN : USB_DIR_OUT) | USB_TYPE_VENDOR;
+        u8 wAddress = B2C2_FLEX_PCIOFFSET_TO_INTERNALADDR(wRegOffsPCI) | (read ? 0x80 : 0);
+
+        int len = usb_control_msg(fc_usb->udev,
+                        read ? B2C2_USB_CTRL_PIPE_IN : B2C2_USB_CTRL_PIPE_OUT,
+                        request,
+                        request_type,  /* 0xc0 read or 0x40 write*/
+                        wAddress,
+                        0,
+                        val,
+                        sizeof(u32),
+                        B2C2_WAIT_FOR_OPERATION_RDW * HZ);
+
+        if (len != sizeof(u32)) {
+                err("error while %s dword from %d (%d).",read ? "reading" : "writing",
+                        wAddress,wRegOffsPCI);
+                return -EIO;
+        }
+        return 0;
+}
+
+/*
+ * DKT 010817 - add support for V8 memory read/write and flash update
+ */
+static int flexcop_usb_v8_memory_req(struct flexcop_usb *fc_usb,
+                flexcop_usb_request_t req, u8 page, u16 wAddress,
+                u8 *pbBuffer,u32 buflen)
+{
+//      u8 dwRequestType;
+        u8 request_type = USB_TYPE_VENDOR;
+        u16 wIndex;
+        int nWaitTime,pipe,len;
+
+        wIndex = page << 8;
+
+        switch (req) {
+                case B2C2_USB_READ_V8_MEM:
+                        nWaitTime = B2C2_WAIT_FOR_OPERATION_V8READ;
+                        request_type |= USB_DIR_IN;
+//                      dwRequestType = (u8) RTYPE_READ_V8_MEMORY;
+                        pipe = B2C2_USB_CTRL_PIPE_IN;
+                break;
+                case B2C2_USB_WRITE_V8_MEM:
+                        wIndex |= pbBuffer[0];
+                        request_type |= USB_DIR_OUT;
+                        nWaitTime = B2C2_WAIT_FOR_OPERATION_V8WRITE;
+//                      dwRequestType = (u8) RTYPE_WRITE_V8_MEMORY;
+                        pipe = B2C2_USB_CTRL_PIPE_OUT;
+                break;
+                case B2C2_USB_FLASH_BLOCK:
+                        request_type |= USB_DIR_OUT;
+                        nWaitTime = B2C2_WAIT_FOR_OPERATION_V8FLASH;
+//                      dwRequestType = (u8) RTYPE_WRITE_V8_FLASH;
+                        pipe = B2C2_USB_CTRL_PIPE_OUT;
+                break;
+                default:
+                        deb_info("unsupported request for v8_mem_req %x.\n",req);
+                return -EINVAL;
+        }
+        deb_v8("v8mem: %02x %02x %04x %04x, len: %d\n",request_type,req,
+                        wAddress,wIndex,buflen);
+
+        len = usb_control_msg(fc_usb->udev,pipe,
+                        req,
+                        request_type,
+                        wAddress,
+                        wIndex,
+                        pbBuffer,
+                        buflen,
+                        nWaitTime * HZ);
+
+        debug_dump(pbBuffer,len,deb_v8);
+
+        return len == buflen ? 0 : -EIO;
+}
+
+#define bytes_left_to_read_on_page(paddr,buflen) \
+                        ((V8_MEMORY_PAGE_SIZE - (paddr & V8_MEMORY_PAGE_MASK)) > buflen \
+                        ? buflen : (V8_MEMORY_PAGE_SIZE - (paddr & V8_MEMORY_PAGE_MASK)))
+
+static int flexcop_usb_memory_req(struct flexcop_usb *fc_usb,flexcop_usb_request_t req,
+                flexcop_usb_mem_page_t page_start, u32 addr, int extended, u8 *buf, u32 len)
+{
+        int i,ret = 0;
+        u16 wMax;
+        u32 pagechunk = 0;
+
+        switch(req) {
+                case B2C2_USB_READ_V8_MEM:  wMax = USB_MEM_READ_MAX; break;
+                case B2C2_USB_WRITE_V8_MEM:     wMax = USB_MEM_WRITE_MAX; break;
+                case B2C2_USB_FLASH_BLOCK:  wMax = USB_FLASH_MAX; break;
+                default:
+                        return -EINVAL;
+                break;
+        }
+        for (i = 0; i < len;) {
+                pagechunk = wMax < bytes_left_to_read_on_page(addr,len) ? wMax : bytes_left_to_read_on_page(addr,len);
+                deb_info("%x\n",(addr & V8_MEMORY_PAGE_MASK) | (V8_MEMORY_EXTENDED*extended));
+                if ((ret = flexcop_usb_v8_memory_req(fc_usb,req,
+                                page_start + (addr / V8_MEMORY_PAGE_SIZE), /* actual page */
+                                (addr & V8_MEMORY_PAGE_MASK) | (V8_MEMORY_EXTENDED*extended),
+                                &buf[i],pagechunk)) < 0)
+                        return ret;
+
+                addr += pagechunk;
+                len -= pagechunk;
+        }
+        return 0;
+}
+
+static int flexcop_usb_get_mac_addr(struct flexcop_device *fc, int extended)
+{
+        return flexcop_usb_memory_req(fc->bus_specific,B2C2_USB_READ_V8_MEM,
+                        V8_MEMORY_PAGE_FLASH,0x1f010,1,fc->dvb_adapter.proposed_mac,6);
+}
+
+#if 0
+static int flexcop_usb_utility_req(struct flexcop_usb *fc_usb, int set,
+                flexcop_usb_utility_function_t func, u8 extra, u16 wIndex,
+                u16 buflen, u8 *pvBuffer)
+{
+        u16 wValue;
+        u8 request_type = (set ? USB_DIR_OUT : USB_DIR_IN) | USB_TYPE_VENDOR;
+//      u8 dwRequestType = (u8) RTYPE_GENERIC,
+        int nWaitTime = 2,
+                pipe = set ? B2C2_USB_CTRL_PIPE_OUT : B2C2_USB_CTRL_PIPE_IN,
+                len;
+
+        wValue = (func << 8) | extra;
+
+        len = usb_control_msg(fc_usb->udev,pipe,
+                        B2C2_USB_UTILITY,
+                        request_type,
+                        wValue,
+                        wIndex,
+                        pvBuffer,
+                        buflen,
+                        nWaitTime * HZ);
+        return len == buflen ? 0 : -EIO;
+}
+#endif
+
+/* usb i2c stuff */
+static int flexcop_usb_i2c_req(struct flexcop_usb *fc_usb,
+                flexcop_usb_request_t req, flexcop_usb_i2c_function_t func,
+                flexcop_i2c_port_t port, u8 chipaddr, u8 addr, u8 *buf, u8 buflen)
+{
+        u16 wValue, wIndex;
+        int nWaitTime,pipe,len;
+//      u8 dwRequestType;
+        u8 request_type = USB_TYPE_VENDOR;
+
+        switch (func) {
+                case USB_FUNC_I2C_WRITE:
+                case USB_FUNC_I2C_MULTIWRITE:
+                case USB_FUNC_I2C_REPEATWRITE:
+                /* DKT 020208 - add this to support special case of DiSEqC */
+                case USB_FUNC_I2C_CHECKWRITE:
+                        pipe = B2C2_USB_CTRL_PIPE_OUT;
+                        nWaitTime = 2;
+//                      dwRequestType = (u8) RTYPE_GENERIC;
+                        request_type |= USB_DIR_OUT;
+                break;
+                case USB_FUNC_I2C_READ:
+                case USB_FUNC_I2C_REPEATREAD:
+                        pipe = B2C2_USB_CTRL_PIPE_IN;
+                        nWaitTime = 2;
+//                      dwRequestType = (u8) RTYPE_GENERIC;
+                        request_type |= USB_DIR_IN;
+                break;
+                default:
+                        deb_info("unsupported function for i2c_req %x\n",func);
+                        return -EINVAL;
+        }
+        wValue = (func << 8 ) | (port << 4);
+        wIndex = (chipaddr << 8 ) | addr;
+
+        deb_i2c("i2c %2d: %02x %02x %02x %02x %02x %02x\n",func,request_type,req,
+                        ((wValue && 0xff) << 8),wValue >> 8,((wIndex && 0xff) << 8),wIndex >> 8);
+
+        len = usb_control_msg(fc_usb->udev,pipe,
+                        req,
+                        request_type,
+                        wValue,
+                        wIndex,
+                        buf,
+                        buflen,
+                        nWaitTime * HZ);
+
+        return len == buflen ? 0 : -EREMOTEIO;
+}
+
+/* actual bus specific access functions, make sure prototype are/will be equal to pci */
+static flexcop_ibi_value flexcop_usb_read_ibi_reg(struct flexcop_device *fc, flexcop_ibi_register reg)
+{
+        flexcop_ibi_value val;
+        val.raw = 0;
+        flexcop_usb_readwrite_dw(fc,reg, &val.raw, 1);
+        return val;
+}
+
+static int flexcop_usb_write_ibi_reg(struct flexcop_device *fc, flexcop_ibi_register reg, flexcop_ibi_value val)
+{
+        return flexcop_usb_readwrite_dw(fc,reg, &val.raw, 0);
+}
+
+static int flexcop_usb_i2c_request(struct flexcop_device *fc, flexcop_access_op_t op,
+                flexcop_i2c_port_t port, u8 chipaddr, u8 addr, u8 *buf, u16 len)
+{
+        if (op == FC_READ)
+                return flexcop_usb_i2c_req(fc->bus_specific,B2C2_USB_I2C_REQUEST,USB_FUNC_I2C_READ,port,chipaddr,addr,buf,len);
+        else
+                return flexcop_usb_i2c_req(fc->bus_specific,B2C2_USB_I2C_REQUEST,USB_FUNC_I2C_WRITE,port,chipaddr,addr,buf,len);
+}
+
+static void flexcop_usb_process_frame(struct flexcop_usb *fc_usb, u8 *buffer, int buffer_length)
+{
+        u8 *b;
+        int l;
+
+        deb_ts("tmp_buffer_length=%d, buffer_length=%d\n", fc_usb->tmp_buffer_length, buffer_length);
+
+        if (fc_usb->tmp_buffer_length > 0) {
+                memcpy(fc_usb->tmp_buffer+fc_usb->tmp_buffer_length, buffer, buffer_length);
+                fc_usb->tmp_buffer_length += buffer_length;
+                b = fc_usb->tmp_buffer;
+                l = fc_usb->tmp_buffer_length;
+        } else {
+                b=buffer;
+                l=buffer_length;
+        }
+
+        while (l >= 190) {
+                if (*b == 0xff)
+                        switch (*(b+1) & 0x03) {
+                                case 0x01: /* media packet */
+                                        if ( *(b+2) == 0x47 )
+                                                flexcop_pass_dmx_packets(fc_usb->fc_dev, b+2, 1);
+                                        else
+                                                deb_ts("not ts packet %02x %02x %02x %02x \n", *(b+2), *(b+3), *(b+4), *(b+5) );
+
+                                        b += 190;
+                                        l -= 190;
+                                break;
+                                default:
+                                        deb_ts("wrong packet type\n");
+                                        l = 0;
+                                break;
+                        }
+                else {
+                        deb_ts("wrong header\n");
+                        l = 0;
+                }
+        }
+
+        if (l>0)
+                memcpy(fc_usb->tmp_buffer, b, l);
+        fc_usb->tmp_buffer_length = l;
+}
+
+static void flexcop_usb_urb_complete(struct urb *urb, struct pt_regs *ptregs)
+{
+        struct flexcop_usb *fc_usb = urb->context;
+        int i;
+
+        if (urb->actual_length > 0)
+                deb_ts("urb completed, bufsize: %d actlen; %d\n",urb->transfer_buffer_length, urb->actual_length);
+
+        for (i = 0; i < urb->number_of_packets; i++) {
+                if (urb->iso_frame_desc[i].status < 0) {
+                        err("iso frame descriptor %d has an error: %d\n",i,urb->iso_frame_desc[i].status);
+                } else
+                        if (urb->iso_frame_desc[i].actual_length > 0) {
+                                deb_ts("passed %d bytes to the demux\n",urb->iso_frame_desc[i].actual_length);
+
+                                flexcop_usb_process_frame(fc_usb,
+                                        urb->transfer_buffer + urb->iso_frame_desc[i].offset,
+                                        urb->iso_frame_desc[i].actual_length);
+                }
+                urb->iso_frame_desc[i].status = 0;
+                urb->iso_frame_desc[i].actual_length = 0;
+        }
+
+        usb_submit_urb(urb,GFP_ATOMIC);
+}
+
+static int flexcop_usb_stream_control(struct flexcop_device *fc, int onoff)
+{
+        /* submit/kill iso packets */
+        return 0;
+}
+
+static void flexcop_usb_transfer_exit(struct flexcop_usb *fc_usb)
+{
+        int i;
+        for (i = 0; i < B2C2_USB_NUM_ISO_URB; i++)
+                if (fc_usb->iso_urb[i] != NULL) {
+                        deb_ts("unlinking/killing urb no. %d\n",i);
+                        usb_kill_urb(fc_usb->iso_urb[i]);
+                        usb_free_urb(fc_usb->iso_urb[i]);
+                }
+
+        if (fc_usb->iso_buffer != NULL)
+                pci_free_consistent(NULL,fc_usb->buffer_size, fc_usb->iso_buffer, fc_usb->dma_addr);
+}
+
+static int flexcop_usb_transfer_init(struct flexcop_usb *fc_usb)
+{
+        u16 frame_size = fc_usb->uintf->cur_altsetting->endpoint[0].desc.wMaxPacketSize;
+        int bufsize = B2C2_USB_NUM_ISO_URB * B2C2_USB_FRAMES_PER_ISO * frame_size,i,j,ret;
+        int buffer_offset = 0;
+
+        deb_ts("creating %d iso-urbs with %d frames each of %d bytes size = %d.\n",
+                        B2C2_USB_NUM_ISO_URB, B2C2_USB_FRAMES_PER_ISO, frame_size,bufsize);
+
+        fc_usb->iso_buffer = pci_alloc_consistent(NULL,bufsize,&fc_usb->dma_addr);
+        if (fc_usb->iso_buffer == NULL)
+                return -ENOMEM;
+        memset(fc_usb->iso_buffer, 0, bufsize);
+        fc_usb->buffer_size = bufsize;
+
+        /* creating iso urbs */
+        for (i = 0; i < B2C2_USB_NUM_ISO_URB; i++)
+                if (!(fc_usb->iso_urb[i] = usb_alloc_urb(B2C2_USB_FRAMES_PER_ISO,GFP_ATOMIC))) {
+                        ret = -ENOMEM;
+                        goto urb_error;
+                }
+        /* initialising and submitting iso urbs */
+        for (i = 0; i < B2C2_USB_NUM_ISO_URB; i++) {
+                int frame_offset = 0;
+                struct urb *urb = fc_usb->iso_urb[i];
+                deb_ts("initializing and submitting urb no. %d (buf_offset: %d).\n",i,buffer_offset);
+
+                urb->dev = fc_usb->udev;
+                urb->context = fc_usb;
+                urb->complete = flexcop_usb_urb_complete;
+                urb->pipe = B2C2_USB_DATA_PIPE;
+                urb->transfer_flags = URB_ISO_ASAP;
+                urb->interval = 1;
+                urb->number_of_packets = B2C2_USB_FRAMES_PER_ISO;
+                urb->transfer_buffer_length = frame_size * B2C2_USB_FRAMES_PER_ISO;
+                urb->transfer_buffer = fc_usb->iso_buffer + buffer_offset;
+
+                buffer_offset += frame_size * B2C2_USB_FRAMES_PER_ISO;
+                for (j = 0; j < B2C2_USB_FRAMES_PER_ISO; j++) {
+                        deb_ts("urb no: %d, frame: %d, frame_offset: %d\n",i,j,frame_offset);
+                        urb->iso_frame_desc[j].offset = frame_offset;
+                        urb->iso_frame_desc[j].length = frame_size;
+                        frame_offset += frame_size;
+                }
+
+                if ((ret = usb_submit_urb(fc_usb->iso_urb[i],GFP_ATOMIC))) {
+                        err("submitting urb %d failed with %d.",i,ret);
+                        goto urb_error;
+                }
+                deb_ts("submitted urb no. %d.\n",i);
+        }
+
+/* SRAM */
+
+        flexcop_sram_set_dest(fc_usb->fc_dev,FC_SRAM_DEST_MEDIA | FC_SRAM_DEST_NET |
+                        FC_SRAM_DEST_CAO | FC_SRAM_DEST_CAI, FC_SRAM_DEST_TARGET_WAN_USB);
+        flexcop_wan_set_speed(fc_usb->fc_dev,FC_WAN_SPEED_8MBITS);
+        flexcop_sram_ctrl(fc_usb->fc_dev,1,1,1);
+
+        ret = 0;
+        goto success;
+urb_error:
+        flexcop_usb_transfer_exit(fc_usb);
+success:
+        return ret;
+}
+
+static int flexcop_usb_init(struct flexcop_usb *fc_usb)
+{
+        /* use the alternate setting with the larges buffer */
+        usb_set_interface(fc_usb->udev,0,1);
+        switch (fc_usb->udev->speed) {
+                case USB_SPEED_LOW:
+                        err("cannot handle USB speed because it is to sLOW.");
+                        return -ENODEV;
+                        break;
+                case USB_SPEED_FULL:
+                        info("running at FULL speed.");
+                        break;
+                case USB_SPEED_HIGH:
+                        info("running at HIGH speed.");
+                        break;
+                case USB_SPEED_UNKNOWN: /* fall through */
+                default:
+                        err("cannot handle USB speed because it is unkown.");
+                        return -ENODEV;
+        }
+        usb_set_intfdata(fc_usb->uintf, fc_usb);
+        return 0;
+}
+
+static void flexcop_usb_exit(struct flexcop_usb *fc_usb)
+{
+        usb_set_intfdata(fc_usb->uintf, NULL);
+}
+
+static int flexcop_usb_probe(struct usb_interface *intf,
+                const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct flexcop_usb *fc_usb = NULL;
+        struct flexcop_device *fc = NULL;
+        int ret;
+
+        if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+                err("out of memory\n");
+                return -ENOMEM;
+        }
+
+/* general flexcop init */
+        fc_usb = fc->bus_specific;
+        fc_usb->fc_dev = fc;
+
+        fc->read_ibi_reg  = flexcop_usb_read_ibi_reg;
+        fc->write_ibi_reg = flexcop_usb_write_ibi_reg;
+        fc->i2c_request = flexcop_usb_i2c_request;
+        fc->get_mac_addr = flexcop_usb_get_mac_addr;
+
+        fc->stream_control = flexcop_usb_stream_control;
+
+        fc->pid_filtering = 1;
+        fc->bus_type = FC_USB;
+
+        fc->dev = &udev->dev;
+        fc->owner = THIS_MODULE;
+
+/* bus specific part */
+        fc_usb->udev = udev;
+        fc_usb->uintf = intf;
+        if ((ret = flexcop_usb_init(fc_usb)) != 0)
+                goto err_kfree;
+
+/* init flexcop */
+        if ((ret = flexcop_device_initialize(fc)) != 0)
+                goto err_usb_exit;
+
+/* xfer init */
+        if ((ret = flexcop_usb_transfer_init(fc_usb)) != 0)
+                goto err_fc_exit;
+
+        info("%s successfully initialized and connected.",DRIVER_NAME);
+        ret = 0;
+        goto success;
+err_fc_exit:
+        flexcop_device_exit(fc);
+err_usb_exit:
+        flexcop_usb_exit(fc_usb);
+err_kfree:
+        flexcop_device_kfree(fc);
+success:
+        return ret;
+}
+
+static void flexcop_usb_disconnect(struct usb_interface *intf)
+{
+        struct flexcop_usb *fc_usb = usb_get_intfdata(intf);
+        flexcop_usb_transfer_exit(fc_usb);
+        flexcop_device_exit(fc_usb->fc_dev);
+        flexcop_usb_exit(fc_usb);
+        flexcop_device_kfree(fc_usb->fc_dev);
+        info("%s successfully deinitialized and disconnected.",DRIVER_NAME);
+}
+
+static struct usb_device_id flexcop_usb_table [] = {
+            { USB_DEVICE(0x0af7, 0x0101) },
+            { }
+};
+
+/* usb specific object needed to register this driver with the usb subsystem */
+static struct usb_driver flexcop_usb_driver = {
+        .owner          = THIS_MODULE,
+        .name           = "Technisat/B2C2 FlexCop II/IIb/III USB",
+        .probe          = flexcop_usb_probe,
+        .disconnect = flexcop_usb_disconnect,
+        .id_table       = flexcop_usb_table,
+};
+
+/* module stuff */
+static int __init flexcop_usb_module_init(void)
+{
+        int result;
+        if ((result = usb_register(&flexcop_usb_driver))) {
+                err("usb_register failed. (%d)",result);
+                return result;
+        }
+
+        return 0;
+}
+
+static void __exit flexcop_usb_module_exit(void)
+{
+        /* deregister this driver from the USB subsystem */
+        usb_deregister(&flexcop_usb_driver);
+}
+
+module_init(flexcop_usb_module_init);
+module_exit(flexcop_usb_module_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_NAME);
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/b2c2/flexcop-usb.h b/drivers/media/dvb/b2c2/flexcop-usb.h
new file mode 100644
index 000000000000..630e647a2caa
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop-usb.h
@@ -0,0 +1,119 @@
+#ifndef __FLEXCOP_USB_H_INCLUDED__
+#define __FLEXCOP_USB_H_INCLUDED__
+
+#include <linux/usb.h>
+
+/* transfer parameters */
+#define B2C2_USB_FRAMES_PER_ISO         4
+#define B2C2_USB_NUM_ISO_URB            4
+
+#define B2C2_USB_CTRL_PIPE_IN           usb_rcvctrlpipe(fc_usb->udev,0)
+#define B2C2_USB_CTRL_PIPE_OUT          usb_sndctrlpipe(fc_usb->udev,0)
+#define B2C2_USB_DATA_PIPE                      usb_rcvisocpipe(fc_usb->udev,0x81)
+
+struct flexcop_usb {
+        struct usb_device *udev;
+        struct usb_interface *uintf;
+
+        u8 *iso_buffer;
+        int buffer_size;
+        dma_addr_t dma_addr;
+        struct urb *iso_urb[B2C2_USB_NUM_ISO_URB];
+
+        struct flexcop_device *fc_dev;
+
+        u8 tmp_buffer[1023+190];
+        int tmp_buffer_length;
+};
+
+#if 0
+/* request types TODO What is its use?*/
+typedef enum {
+
+/* something is wrong with this part
+        RTYPE_READ_DW         = (1 << 6),
+        RTYPE_WRITE_DW_1      = (3 << 6),
+        RTYPE_READ_V8_MEMORY  = (6 << 6),
+        RTYPE_WRITE_V8_MEMORY = (7 << 6),
+        RTYPE_WRITE_V8_FLASH  = (8 << 6),
+        RTYPE_GENERIC         = (9 << 6),
+*/
+} flexcop_usb_request_type_t;
+#endif
+
+/* request */
+typedef enum {
+        B2C2_USB_WRITE_V8_MEM = 0x04,
+        B2C2_USB_READ_V8_MEM  = 0x05,
+        B2C2_USB_READ_REG     = 0x08,
+        B2C2_USB_WRITE_REG    = 0x0A,
+/*      B2C2_USB_WRITEREGLO   = 0x0A, */
+        B2C2_USB_WRITEREGHI   = 0x0B,
+        B2C2_USB_FLASH_BLOCK  = 0x10,
+        B2C2_USB_I2C_REQUEST  = 0x11,
+        B2C2_USB_UTILITY      = 0x12,
+} flexcop_usb_request_t;
+
+/* function definition for I2C_REQUEST */
+typedef enum {
+        USB_FUNC_I2C_WRITE       = 0x01,
+        USB_FUNC_I2C_MULTIWRITE  = 0x02,
+        USB_FUNC_I2C_READ        = 0x03,
+        USB_FUNC_I2C_REPEATWRITE = 0x04,
+        USB_FUNC_GET_DESCRIPTOR  = 0x05,
+        USB_FUNC_I2C_REPEATREAD  = 0x06,
+/* DKT 020208 - add this to support special case of DiSEqC */
+        USB_FUNC_I2C_CHECKWRITE  = 0x07,
+        USB_FUNC_I2C_CHECKRESULT = 0x08,
+} flexcop_usb_i2c_function_t;
+
+/*
+ * function definition for UTILITY request 0x12
+ * DKT 020304 - new utility function
+ */
+typedef enum {
+        UTILITY_SET_FILTER          = 0x01,
+        UTILITY_DATA_ENABLE         = 0x02,
+        UTILITY_FLEX_MULTIWRITE     = 0x03,
+        UTILITY_SET_BUFFER_SIZE     = 0x04,
+        UTILITY_FLEX_OPERATOR       = 0x05,
+        UTILITY_FLEX_RESET300_START = 0x06,
+        UTILITY_FLEX_RESET300_STOP  = 0x07,
+        UTILITY_FLEX_RESET300       = 0x08,
+        UTILITY_SET_ISO_SIZE        = 0x09,
+        UTILITY_DATA_RESET          = 0x0A,
+        UTILITY_GET_DATA_STATUS     = 0x10,
+        UTILITY_GET_V8_REG          = 0x11,
+/* DKT 020326 - add function for v1.14 */
+        UTILITY_SRAM_WRITE          = 0x12,
+        UTILITY_SRAM_READ           = 0x13,
+        UTILITY_SRAM_TESTFILL       = 0x14,
+        UTILITY_SRAM_TESTSET        = 0x15,
+        UTILITY_SRAM_TESTVERIFY     = 0x16,
+} flexcop_usb_utility_function_t;
+
+#define B2C2_WAIT_FOR_OPERATION_RW  1*HZ       /* 1 s */
+#define B2C2_WAIT_FOR_OPERATION_RDW 3*HZ       /* 3 s */
+#define B2C2_WAIT_FOR_OPERATION_WDW 1*HZ       /* 1 s */
+
+#define B2C2_WAIT_FOR_OPERATION_V8READ   3*HZ  /* 3 s */
+#define B2C2_WAIT_FOR_OPERATION_V8WRITE  3*HZ  /* 3 s */
+#define B2C2_WAIT_FOR_OPERATION_V8FLASH  3*HZ  /* 3 s */
+
+typedef enum {
+        V8_MEMORY_PAGE_DVB_CI = 0x20,
+        V8_MEMORY_PAGE_DVB_DS = 0x40,
+        V8_MEMORY_PAGE_MULTI2 = 0x60,
+        V8_MEMORY_PAGE_FLASH  = 0x80
+} flexcop_usb_mem_page_t;
+
+#define V8_MEMORY_EXTENDED      (1 << 15)
+
+#define USB_MEM_READ_MAX                32
+#define USB_MEM_WRITE_MAX               1
+#define USB_FLASH_MAX                   8
+
+#define V8_MEMORY_PAGE_SIZE     0x8000      // 32K
+#define V8_MEMORY_PAGE_MASK     0x7FFF
+
+#endif
diff --git a/drivers/media/dvb/b2c2/flexcop.c b/drivers/media/dvb/b2c2/flexcop.c
new file mode 100644
index 000000000000..8b5d14dd36e3
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop.c
@@ -0,0 +1,286 @@
+/*
+ * flexcop.c - driver for digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * Copyright (C) 2004-5 Patrick Boettcher <patrick.boettcher@desy.de>
+ *
+ * based on the skystar2-driver
+ * Copyright (C) 2003 Vadim Catana, skystar@moldova.cc
+ *
+ * Acknowledgements:
+ *     John Jurrius from BBTI, Inc. for extensive support with
+ *         code examples and data books
+ *
+ *     Bjarne Steinsbo, bjarne at steinsbo.com (some ideas for rewriting)
+ *
+ * Contributions to the skystar2-driver have been done by
+ *     Vincenzo Di Massa, hawk.it at tiscalinet.it (several DiSEqC fixes)
+ *     Roberto Ragusa, r.ragusa at libero.it (polishing, restyling the code)
+ *     Niklas Peinecke, peinecke at gdv.uni-hannover.de (hardware pid/mac filtering)
+ *
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include "flexcop.h"
+
+#define DRIVER_NAME "B2C2 FlexcopII/II(b)/III digital TV receiver chip"
+#define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de"
+
+#ifdef CONFIG_DVB_B2C2_FLEXCOP_DEBUG
+#define DEBSTATUS ""
+#else
+#define DEBSTATUS " (debugging is not enabled)"
+#endif
+
+int b2c2_flexcop_debug;
+module_param_named(debug, b2c2_flexcop_debug,  int, 0644);
+MODULE_PARM_DESC(debug, "set debug level (1=info,2=tuner,4=i2c,8=ts,16=sram (|-able))." DEBSTATUS);
+#undef DEBSTATUS
+
+/* global zero for ibi values */
+flexcop_ibi_value ibi_zero;
+
+static int flexcop_dvb_start_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+        struct flexcop_device *fc = dvbdmxfeed->demux->priv;
+        return flexcop_pid_feed_control(fc,dvbdmxfeed,1);
+}
+
+static int flexcop_dvb_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+        struct flexcop_device *fc = dvbdmxfeed->demux->priv;
+        return flexcop_pid_feed_control(fc,dvbdmxfeed,0);
+}
+
+static int flexcop_dvb_init(struct flexcop_device *fc)
+{
+        int ret;
+        if ((ret = dvb_register_adapter(&fc->dvb_adapter,"FlexCop Digital TV device",fc->owner)) < 0) {
+                err("error registering DVB adapter");
+                return ret;
+        }
+        fc->dvb_adapter.priv = fc;
+
+        fc->demux.dmx.capabilities = (DMX_TS_FILTERING | DMX_SECTION_FILTERING | DMX_MEMORY_BASED_FILTERING);
+        fc->demux.priv = fc;
+
+        fc->demux.filternum = fc->demux.feednum = FC_MAX_FEED;
+
+        fc->demux.start_feed = flexcop_dvb_start_feed;
+        fc->demux.stop_feed = flexcop_dvb_stop_feed;
+        fc->demux.write_to_decoder = NULL;
+
+        if ((ret = dvb_dmx_init(&fc->demux)) < 0) {
+                err("dvb_dmx failed: error %d",ret);
+                goto err_dmx;
+        }
+
+        fc->hw_frontend.source = DMX_FRONTEND_0;
+
+        fc->dmxdev.filternum = fc->demux.feednum;
+        fc->dmxdev.demux = &fc->demux.dmx;
+        fc->dmxdev.capabilities = 0;
+        if ((ret = dvb_dmxdev_init(&fc->dmxdev, &fc->dvb_adapter)) < 0) {
+                err("dvb_dmxdev_init failed: error %d",ret);
+                goto err_dmx_dev;
+        }
+
+        if ((ret = fc->demux.dmx.add_frontend(&fc->demux.dmx, &fc->hw_frontend)) < 0) {
+                err("adding hw_frontend to dmx failed: error %d",ret);
+                goto err_dmx_add_hw_frontend;
+        }
+
+        fc->mem_frontend.source = DMX_MEMORY_FE;
+        if ((ret = fc->demux.dmx.add_frontend(&fc->demux.dmx, &fc->mem_frontend)) < 0) {
+                err("adding mem_frontend to dmx failed: error %d",ret);
+                goto err_dmx_add_mem_frontend;
+        }
+
+        if ((ret = fc->demux.dmx.connect_frontend(&fc->demux.dmx, &fc->hw_frontend)) < 0) {
+                err("connect frontend failed: error %d",ret);
+                goto err_connect_frontend;
+        }
+
+        dvb_net_init(&fc->dvb_adapter, &fc->dvbnet, &fc->demux.dmx);
+
+        fc->init_state |= FC_STATE_DVB_INIT;
+        goto success;
+
+err_connect_frontend:
+        fc->demux.dmx.remove_frontend(&fc->demux.dmx,&fc->mem_frontend);
+err_dmx_add_mem_frontend:
+        fc->demux.dmx.remove_frontend(&fc->demux.dmx,&fc->hw_frontend);
+err_dmx_add_hw_frontend:
+        dvb_dmxdev_release(&fc->dmxdev);
+err_dmx_dev:
+        dvb_dmx_release(&fc->demux);
+err_dmx:
+        dvb_unregister_adapter(&fc->dvb_adapter);
+        return ret;
+
+success:
+        return 0;
+}
+
+static void flexcop_dvb_exit(struct flexcop_device *fc)
+{
+        if (fc->init_state & FC_STATE_DVB_INIT) {
+                dvb_net_release(&fc->dvbnet);
+
+                fc->demux.dmx.close(&fc->demux.dmx);
+                fc->demux.dmx.remove_frontend(&fc->demux.dmx,&fc->mem_frontend);
+                fc->demux.dmx.remove_frontend(&fc->demux.dmx,&fc->hw_frontend);
+                dvb_dmxdev_release(&fc->dmxdev);
+                dvb_dmx_release(&fc->demux);
+                dvb_unregister_adapter(&fc->dvb_adapter);
+
+                deb_info("deinitialized dvb stuff\n");
+        }
+        fc->init_state &= ~FC_STATE_DVB_INIT;
+}
+
+/* these methods are necessary to achieve the long-term-goal of hiding the
+ * struct flexcop_device from the bus-parts */
+void flexcop_pass_dmx_data(struct flexcop_device *fc, u8 *buf, u32 len)
+{
+        dvb_dmx_swfilter(&fc->demux, buf, len);
+}
+EXPORT_SYMBOL(flexcop_pass_dmx_data);
+
+void flexcop_pass_dmx_packets(struct flexcop_device *fc, u8 *buf, u32 no)
+{
+        dvb_dmx_swfilter_packets(&fc->demux, buf, no);
+}
+EXPORT_SYMBOL(flexcop_pass_dmx_packets);
+
+static void flexcop_reset(struct flexcop_device *fc)
+{
+        flexcop_ibi_value v210,v204;
+
+/* reset the flexcop itself */
+        fc->write_ibi_reg(fc,ctrl_208,ibi_zero);
+
+        v210.raw = 0;
+        v210.sw_reset_210.reset_blocks = 0xff;
+        v210.sw_reset_210.Block_reset_enable = 0xb2;
+        fc->write_ibi_reg(fc,sw_reset_210,v210);
+
+/* reset the periphical devices */
+
+        v204 = fc->read_ibi_reg(fc,misc_204);
+        v204.misc_204.Per_reset_sig = 0;
+        fc->write_ibi_reg(fc,misc_204,v204);
+        v204.misc_204.Per_reset_sig = 1;
+        fc->write_ibi_reg(fc,misc_204,v204);
+}
+
+struct flexcop_device *flexcop_device_kmalloc(size_t bus_specific_len)
+{
+        void *bus;
+        struct flexcop_device *fc = kmalloc(sizeof(struct flexcop_device), GFP_KERNEL);
+        if (!fc) {
+                err("no memory");
+                return NULL;
+        }
+        memset(fc, 0, sizeof(struct flexcop_device));
+
+        bus = kmalloc(bus_specific_len, GFP_KERNEL);
+        if (!bus) {
+                err("no memory");
+                kfree(fc);
+                return NULL;
+        }
+        memset(bus, 0, bus_specific_len);
+
+        fc->bus_specific = bus;
+
+        return fc;
+}
+EXPORT_SYMBOL(flexcop_device_kmalloc);
+
+void flexcop_device_kfree(struct flexcop_device *fc)
+{
+        kfree(fc->bus_specific);
+        kfree(fc);
+}
+EXPORT_SYMBOL(flexcop_device_kfree);
+
+int flexcop_device_initialize(struct flexcop_device *fc)
+{
+        int ret;
+        ibi_zero.raw = 0;
+
+        flexcop_reset(fc);
+        flexcop_determine_revision(fc);
+        flexcop_sram_init(fc);
+        flexcop_hw_filter_init(fc);
+
+        flexcop_smc_ctrl(fc, 0);
+
+        if ((ret = flexcop_dvb_init(fc)))
+                goto error;
+
+        /* do the MAC address reading after initializing the dvb_adapter */
+        if (fc->get_mac_addr(fc, 0) == 0) {
+                u8 *b = fc->dvb_adapter.proposed_mac;
+                info("MAC address = %02x:%02x:%02x:%02x:%02x:%02x", b[0],b[1],b[2],b[3],b[4],b[5]);
+                flexcop_set_mac_filter(fc,b);
+                flexcop_mac_filter_ctrl(fc,1);
+        } else
+                warn("reading of MAC address failed.\n");
+
+
+        if ((ret = flexcop_i2c_init(fc)))
+                goto error;
+
+        if ((ret = flexcop_frontend_init(fc)))
+                goto error;
+
+        flexcop_device_name(fc,"initialization of","complete");
+
+        ret = 0;
+        goto success;
+error:
+        flexcop_device_exit(fc);
+success:
+        return ret;
+}
+EXPORT_SYMBOL(flexcop_device_initialize);
+
+void flexcop_device_exit(struct flexcop_device *fc)
+{
+        flexcop_frontend_exit(fc);
+        flexcop_i2c_exit(fc);
+        flexcop_dvb_exit(fc);
+}
+EXPORT_SYMBOL(flexcop_device_exit);
+
+static int flexcop_module_init(void)
+{
+        info(DRIVER_NAME " loaded successfully");
+        return 0;
+}
+
+static void flexcop_module_cleanup(void)
+{
+        info(DRIVER_NAME " unloaded successfully");
+}
+
+module_init(flexcop_module_init);
+module_exit(flexcop_module_cleanup);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_NAME);
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/b2c2/flexcop.h b/drivers/media/dvb/b2c2/flexcop.h
new file mode 100644
index 000000000000..caa343a97bdc
--- /dev/null
+++ b/drivers/media/dvb/b2c2/flexcop.h
@@ -0,0 +1,30 @@
+/*
+ * This file is part of linux driver the digital TV devices equipped with B2C2 FlexcopII(b)/III
+ *
+ * flexcop.h - private header file for all flexcop-chip-source files.
+ *
+ * see flexcop.c for copyright information.
+ */
+#ifndef __FLEXCOP_H__
+#define __FLEXCOP_H___
+
+#define FC_LOG_PREFIX "b2c2-flexcop"
+#include "flexcop-common.h"
+
+extern int b2c2_flexcop_debug;
+
+/* debug */
+#ifdef CONFIG_DVB_B2C2_FLEXCOP_DEBUG
+#define dprintk(level,args...) \
+        do { if ((b2c2_flexcop_debug & level)) printk(args); } while (0)
+#else
+#define dprintk(level,args...)
+#endif
+
+#define deb_info(args...)  dprintk(0x01,args)
+#define deb_tuner(args...) dprintk(0x02,args)
+#define deb_i2c(args...)   dprintk(0x04,args)
+#define deb_ts(args...)    dprintk(0x08,args)
+#define deb_sram(args...)  dprintk(0x10,args)
+
+#endif
diff --git a/drivers/media/dvb/b2c2/skystar2.c b/drivers/media/dvb/b2c2/skystar2.c
index 336c178fcd5f..acbc4c34f72a 100644
--- a/drivers/media/dvb/b2c2/skystar2.c
+++ b/drivers/media/dvb/b2c2/skystar2.c
@@ -97,7 +97,7 @@ struct adapter {
         u8 mac_addr[8];
         u32 dw_sram_type;
 
-        struct dvb_adapter *dvb_adapter;
+        struct dvb_adapter dvb_adapter;
         struct dvb_demux demux;
         struct dmxdev dmxdev;
         struct dmx_frontend hw_frontend;
@@ -2461,7 +2461,7 @@ static void frontend_init(struct adapter *skystar2)
                        skystar2->pdev->subsystem_vendor,
                        skystar2->pdev->subsystem_device);
         } else {
-                if (dvb_register_frontend(skystar2->dvb_adapter, skystar2->fe)) {
+                if (dvb_register_frontend(&skystar2->dvb_adapter, skystar2->fe)) {
                         printk("skystar2: Frontend registration failed!\n");
                         if (skystar2->fe->ops->release)
                                 skystar2->fe->ops->release(skystar2->fe);
@@ -2486,17 +2486,17 @@ static int skystar2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ret < 0)
                 goto out;
 
-        ret = dvb_register_adapter(&dvb_adapter, skystar2_pci_driver.name,
+        adapter = pci_get_drvdata(pdev);
+        dvb_adapter = &adapter->dvb_adapter;
+
+        ret = dvb_register_adapter(dvb_adapter, skystar2_pci_driver.name,
                                    THIS_MODULE);
         if (ret < 0) {
                 printk("%s: Error registering DVB adapter\n", __FUNCTION__);
                 goto err_halt;
         }
 
-        adapter = pci_get_drvdata(pdev);
-
         dvb_adapter->priv = adapter;
-        adapter->dvb_adapter = dvb_adapter;
 
 
         init_MUTEX(&adapter->i2c_sem);
@@ -2541,7 +2541,7 @@ static int skystar2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         adapter->dmxdev.demux = dmx;
         adapter->dmxdev.capabilities = 0;
 
-        ret = dvb_dmxdev_init(&adapter->dmxdev, adapter->dvb_adapter);
+        ret = dvb_dmxdev_init(&adapter->dmxdev, &adapter->dvb_adapter);
         if (ret < 0)
                 goto err_dmx_release;
 
@@ -2559,7 +2559,7 @@ static int skystar2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ret < 0)
                 goto err_remove_mem_frontend;
 
-        dvb_net_init(adapter->dvb_adapter, &adapter->dvbnet, &dvbdemux->dmx);
+        dvb_net_init(&adapter->dvb_adapter, &adapter->dvbnet, &dvbdemux->dmx);
 
         frontend_init(adapter);
 out:
@@ -2576,7 +2576,7 @@ err_dmx_release:
 err_i2c_del:
         i2c_del_adapter(&adapter->i2c_adap);
 err_dvb_unregister:
-        dvb_unregister_adapter(adapter->dvb_adapter);
+        dvb_unregister_adapter(&adapter->dvb_adapter);
 err_halt:
         driver_halt(pdev);
         goto out;
@@ -2605,7 +2605,7 @@ static void skystar2_remove(struct pci_dev *pdev)
         if (adapter->fe != NULL)
                 dvb_unregister_frontend(adapter->fe);
 
-        dvb_unregister_adapter(adapter->dvb_adapter);
+        dvb_unregister_adapter(&adapter->dvb_adapter);
 
                         i2c_del_adapter(&adapter->i2c_adap);
 
diff --git a/drivers/media/dvb/bt8xx/Kconfig b/drivers/media/dvb/bt8xx/Kconfig
index e7d11e0667a8..b12545f093f8 100644
--- a/drivers/media/dvb/bt8xx/Kconfig
+++ b/drivers/media/dvb/bt8xx/Kconfig
@@ -11,9 +11,8 @@ config DVB_BT8XX
           the Nebula cards, the Pinnacle PCTV cards, the Twinhan DST cards and
           pcHDTV HD2000 cards.
 
-          Since these cards have no MPEG decoder onboard, they transmit
+          Since these cards have no MPEG decoder onboard, they transmit
           only compressed MPEG data over the PCI bus, so you need
           an external software decoder to watch TV on your computer.
 
           Say Y if you own such a device and want to use it.
-
diff --git a/drivers/media/dvb/bt8xx/Makefile b/drivers/media/dvb/bt8xx/Makefile
index 9da8604b9e18..d188e4c670b5 100644
--- a/drivers/media/dvb/bt8xx/Makefile
+++ b/drivers/media/dvb/bt8xx/Makefile
@@ -1,5 +1,3 @@
-
-obj-$(CONFIG_DVB_BT8XX) += bt878.o dvb-bt8xx.o dst.o
+obj-$(CONFIG_DVB_BT8XX) += bt878.o dvb-bt8xx.o dst.o dst_ca.o
 
 EXTRA_CFLAGS = -Idrivers/media/dvb/dvb-core/ -Idrivers/media/video -Idrivers/media/dvb/frontends
-
diff --git a/drivers/media/dvb/bt8xx/bt878.c b/drivers/media/dvb/bt8xx/bt878.c
index 213ff7902024..3c5a8e273c4a 100644
--- a/drivers/media/dvb/bt8xx/bt878.c
+++ b/drivers/media/dvb/bt8xx/bt878.c
@@ -4,27 +4,27 @@
  * Copyright (C) 2002 Peter Hettkamp <peter.hettkamp@t-online.de>
  *
  * large parts based on the bttv driver
- * Copyright (C) 1996,97,98 Ralph  Metzler (rjkm@thp.uni-koeln.de)
- *                        & Marcus Metzler (mocm@thp.uni-koeln.de)
+ * Copyright (C) 1996,97,98 Ralph  Metzler (rjkm@metzlerbros.de)
+ *                        & Marcus Metzler (mocm@metzlerbros.de)
  * (c) 1999,2000 Gerd Knorr <kraxel@goldbach.in-berlin.de>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
  * as published by the Free Software Foundation; either version 2
  * of the License, or (at your option) any later version.
- * 
+ *
 
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- * 
+ *
 
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  * Or, point your browser to http://www.gnu.org/copyleft/gpl.html
- * 
+ *
  */
 
 #include <linux/module.h>
@@ -58,7 +58,7 @@ module_param_named(verbose, bt878_verbose, int, 0444);
 MODULE_PARM_DESC(verbose,
                  "verbose startup messages, default is 1 (yes)");
 module_param_named(debug, bt878_debug, int, 0644);
-MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
+MODULE_PARM_DESC(debug, "Turn on/off debugging, default is 0 (off).");
 
 int bt878_num;
 struct bt878 bt878[BT878_MAX];
@@ -128,21 +128,21 @@ static int bt878_mem_alloc(struct bt878 *bt)
 }
 
 /* RISC instructions */
-#define RISC_WRITE              (0x01 << 28)
-#define RISC_JUMP               (0x07 << 28)
-#define RISC_SYNC               (0x08 << 28)
+#define RISC_WRITE              (0x01 << 28)
+#define RISC_JUMP               (0x07 << 28)
+#define RISC_SYNC               (0x08 << 28)
 
 /* RISC bits */
-#define RISC_WR_SOL             (1 << 27)
-#define RISC_WR_EOL             (1 << 26)
-#define RISC_IRQ                (1 << 24)
+#define RISC_WR_SOL             (1 << 27)
+#define RISC_WR_EOL             (1 << 26)
+#define RISC_IRQ                (1 << 24)
 #define RISC_STATUS(status)     ((((~status) & 0x0F) << 20) | ((status & 0x0F) << 16))
-#define RISC_SYNC_RESYNC        (1 << 15)
-#define RISC_SYNC_FM1           0x06
-#define RISC_SYNC_VRO           0x0C
+#define RISC_SYNC_RESYNC        (1 << 15)
+#define RISC_SYNC_FM1           0x06
+#define RISC_SYNC_VRO           0x0C
 
 #define RISC_FLUSH()            bt->risc_pos = 0
-#define RISC_INSTR(instr)       bt->risc_cpu[bt->risc_pos++] = cpu_to_le32(instr)
+#define RISC_INSTR(instr)       bt->risc_cpu[bt->risc_pos++] = cpu_to_le32(instr)
 
 static int bt878_make_risc(struct bt878 *bt)
 {
@@ -173,7 +173,7 @@ static void bt878_risc_program(struct bt878 *bt, u32 op_sync_orin)
         RISC_INSTR(RISC_SYNC | RISC_SYNC_FM1 | op_sync_orin);
         RISC_INSTR(0);
 
-        dprintk("bt878: risc len lines %u, bytes per line %u\n", 
+        dprintk("bt878: risc len lines %u, bytes per line %u\n",
                         bt->line_count, bt->line_bytes);
         for (line = 0; line < bt->line_count; line++) {
                 // At the beginning of every block we issue an IRQ with previous (finished) block number set
@@ -228,14 +228,14 @@ void bt878_start(struct bt878 *bt, u32 controlreg, u32 op_sync_orin,
          * Hacked for DST to:
          * SCERR | OCERR | FDSR | FTRGT | FBUS | RISCI
          */
-        int_mask = BT878_ASCERR | BT878_AOCERR | BT878_APABORT | 
-                BT878_ARIPERR | BT878_APPERR | BT878_AFDSR | BT878_AFTRGT | 
+        int_mask = BT878_ASCERR | BT878_AOCERR | BT878_APABORT |
+                BT878_ARIPERR | BT878_APPERR | BT878_AFDSR | BT878_AFTRGT |
                 BT878_AFBUS | BT878_ARISCI;
 
 
         /* ignore pesky bits */
         int_mask &= ~irq_err_ignore;
-        
+
         btwrite(int_mask, BT878_AINT_MASK);
         btwrite(controlreg, BT878_AGPIO_DMA_CTL);
 }
@@ -461,9 +461,9 @@ static int __devinit bt878_probe(struct pci_dev *dev,
         pci_set_drvdata(dev, bt);
 
 /*        if(init_bt878(btv) < 0) {
-                bt878_remove(dev);
-                return -EIO;
-        }
+                bt878_remove(dev);
+                return -EIO;
+        }
 */
 
         if ((result = bt878_mem_alloc(bt))) {
@@ -536,10 +536,10 @@ static struct pci_device_id bt878_pci_tbl[] __devinitdata = {
 MODULE_DEVICE_TABLE(pci, bt878_pci_tbl);
 
 static struct pci_driver bt878_pci_driver = {
-      .name     = "bt878",
+      .name     = "bt878",
       .id_table = bt878_pci_tbl,
-      .probe    = bt878_probe,
-      .remove   = bt878_remove,
+      .probe    = bt878_probe,
+      .remove   = bt878_remove,
 };
 
 static int bt878_pci_driver_registered = 0;
@@ -558,7 +558,7 @@ static int bt878_init_module(void)
                (BT878_VERSION_CODE >> 8) & 0xff,
                BT878_VERSION_CODE & 0xff);
 /*
-        bt878_check_chipset();
+        bt878_check_chipset();
 */
         /* later we register inside of bt878_find_audio_dma()
          * because we may want to ignore certain cards */
diff --git a/drivers/media/dvb/bt8xx/bt878.h b/drivers/media/dvb/bt8xx/bt878.h
index e1b9809d1b08..837623f7fcdf 100644
--- a/drivers/media/dvb/bt8xx/bt878.h
+++ b/drivers/media/dvb/bt8xx/bt878.h
@@ -1,4 +1,4 @@
-/* 
+/*
     bt878.h - Bt878 audio module (register offsets)
 
     Copyright (C) 2002 Peter Hettkamp <peter.hettkamp@t-online.de>
@@ -120,14 +120,14 @@ struct bt878 {
         u32 risc_pos;
 
         struct tasklet_struct tasklet;
-        int shutdown;   
+        int shutdown;
 };
 
 extern struct bt878 bt878[BT878_MAX];
 
 void bt878_start(struct bt878 *bt, u32 controlreg, u32 op_sync_orin,
                 u32 irq_err_ignore);
-void bt878_stop(struct bt878 *bt);           
+void bt878_stop(struct bt878 *bt);
 
 #if defined(__powerpc__)        /* big-endian */
 extern __inline__ void io_st_le32(volatile unsigned __iomem *addr, unsigned val)
diff --git a/drivers/media/dvb/bt8xx/dst.c b/drivers/media/dvb/bt8xx/dst.c
index eac83768dfd0..d047e349d706 100644
--- a/drivers/media/dvb/bt8xx/dst.c
+++ b/drivers/media/dvb/bt8xx/dst.c
@@ -1,25 +1,25 @@
 /*
-    Frontend-driver for TwinHan DST Frontend
 
-    Copyright (C) 2003 Jamie Honan
+        Frontend/Card driver for TwinHan DST Frontend
+        Copyright (C) 2003 Jamie Honan
+        Copyright (C) 2004, 2005 Manu Abraham (manu@kromtek.com)
 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
 
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
 
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the Free Software
+        Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
+
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -31,59 +31,22 @@
 
 #include "dvb_frontend.h"
 #include "dst_priv.h"
-#include "dst.h"
-
-struct dst_state {
-
-        struct i2c_adapter* i2c;
-
-        struct bt878* bt;
-
-        struct dvb_frontend_ops ops;
-
-        /* configuration settings */
-        const struct dst_config* config;
-
-        struct dvb_frontend frontend;
-
-        /* private demodulator data */
-        u8 tx_tuna[10];
-        u8 rx_tuna[10];
-        u8 rxbuffer[10];
-        u8 diseq_flags;
-        u8 dst_type;
-        u32 type_flags;
-        u32 frequency;          /* intermediate frequency in kHz for QPSK */
-        fe_spectral_inversion_t inversion;
-        u32 symbol_rate;        /* symbol rate in Symbols per second */
-        fe_code_rate_t fec;
-        fe_sec_voltage_t voltage;
-        fe_sec_tone_mode_t tone;
-        u32 decode_freq;
-        u8 decode_lock;
-        u16 decode_strength;
-        u16 decode_snr;
-        unsigned long cur_jiff;
-        u8 k22;
-        fe_bandwidth_t bandwidth;
-};
+#include "dst_common.h"
 
-static unsigned int dst_verbose = 0;
-module_param(dst_verbose, int, 0644);
-MODULE_PARM_DESC(dst_verbose, "verbose startup messages, default is 1 (yes)");
-static unsigned int dst_debug = 0;
-module_param(dst_debug, int, 0644);
-MODULE_PARM_DESC(dst_debug, "debug messages, default is 0 (no)");
 
-#define dprintk if (dst_debug) printk
+static unsigned int verbose = 1;
+module_param(verbose, int, 0644);
+MODULE_PARM_DESC(verbose, "verbose startup messages, default is 1 (yes)");
 
-#define DST_TYPE_IS_SAT         0
-#define DST_TYPE_IS_TERR        1
-#define DST_TYPE_IS_CABLE       2
+static unsigned int debug = 1;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "debug messages, default is 0 (yes)");
 
-#define DST_TYPE_HAS_NEWTUNE    1
-#define DST_TYPE_HAS_TS204      2
-#define DST_TYPE_HAS_SYMDIV     4
+static unsigned int dst_addons;
+module_param(dst_addons, int, 0644);
+MODULE_PARM_DESC(dst_addons, "CA daughterboard, default is 0 (No addons)");
+
+#define dprintk if (debug) printk
 
 #define HAS_LOCK        1
 #define ATTEMPT_TUNE    2
@@ -97,7 +60,7 @@ static void dst_packsize(struct dst_state* state, int psize)
         bt878_device_control(state->bt, DST_IG_TS, &bits);
 }
 
-static int dst_gpio_outb(struct dst_state* state, u32 mask, u32 enbb, u32 outhigh)
+int dst_gpio_outb(struct dst_state* state, u32 mask, u32 enbb, u32 outhigh, int delay)
 {
         union dst_gpio_packet enb;
         union dst_gpio_packet bits;
@@ -105,26 +68,33 @@ static int dst_gpio_outb(struct dst_state* state, u32 mask, u32 enbb, u32 outhig
 
         enb.enb.mask = mask;
         enb.enb.enable = enbb;
+        if (verbose > 4)
+                dprintk("%s: mask=[%04x], enbb=[%04x], outhigh=[%04x]\n", __FUNCTION__, mask, enbb, outhigh);
+
         if ((err = bt878_device_control(state->bt, DST_IG_ENABLE, &enb)) < 0) {
-                dprintk("%s: dst_gpio_enb error (err == %i, mask == 0x%02x, enb == 0x%02x)\n", __FUNCTION__, err, mask, enbb);
+                dprintk("%s: dst_gpio_enb error (err == %i, mask == %02x, enb == %02x)\n", __FUNCTION__, err, mask, enbb);
                 return -EREMOTEIO;
         }
-
+        udelay(1000);
         /* because complete disabling means no output, no need to do output packet */
         if (enbb == 0)
                 return 0;
 
+        if (delay)
+                msleep(10);
+
         bits.outp.mask = enbb;
         bits.outp.highvals = outhigh;
 
         if ((err = bt878_device_control(state->bt, DST_IG_WRITE, &bits)) < 0) {
-                dprintk("%s: dst_gpio_outb error (err == %i, enbb == 0x%02x, outhigh == 0x%02x)\n", __FUNCTION__, err, enbb, outhigh);
+                dprintk("%s: dst_gpio_outb error (err == %i, enbb == %02x, outhigh == %02x)\n", __FUNCTION__, err, enbb, outhigh);
                 return -EREMOTEIO;
         }
         return 0;
 }
+EXPORT_SYMBOL(dst_gpio_outb);
 
-static int dst_gpio_inb(struct dst_state *state, u8 * result)
+int dst_gpio_inb(struct dst_state *state, u8 * result)
 {
         union dst_gpio_packet rd_packet;
         int err;
@@ -139,143 +109,225 @@ static int dst_gpio_inb(struct dst_state *state, u8 * result)
         *result = (u8) rd_packet.rd.value;
         return 0;
 }
+EXPORT_SYMBOL(dst_gpio_inb);
 
-#define DST_I2C_ENABLE  1
-#define DST_8820        2
-
-static int dst_reset8820(struct dst_state *state)
+int rdc_reset_state(struct dst_state *state)
 {
-        int retval;
-        /* pull 8820 gpio pin low, wait, high, wait, then low */
-        // dprintk ("%s: reset 8820\n", __FUNCTION__);
-        retval = dst_gpio_outb(state, DST_8820, DST_8820, 0);
-        if (retval < 0)
-                return retval;
+        if (verbose > 1)
+                dprintk("%s: Resetting state machine\n", __FUNCTION__);
+
+        if (dst_gpio_outb(state, RDC_8820_INT, RDC_8820_INT, 0, NO_DELAY) < 0) {
+                dprintk("%s: dst_gpio_outb ERROR !\n", __FUNCTION__);
+                return -1;
+        }
+
         msleep(10);
-        retval = dst_gpio_outb(state, DST_8820, DST_8820, DST_8820);
-        if (retval < 0)
-                return retval;
-        /* wait for more feedback on what works here *
-           msleep(10);
-           retval = dst_gpio_outb(dst, DST_8820, DST_8820, 0);
-           if (retval < 0)
-           return retval;
-         */
+
+        if (dst_gpio_outb(state, RDC_8820_INT, RDC_8820_INT, RDC_8820_INT, NO_DELAY) < 0) {
+                dprintk("%s: dst_gpio_outb ERROR !\n", __FUNCTION__);
+                msleep(10);
+                return -1;
+        }
+
         return 0;
 }
+EXPORT_SYMBOL(rdc_reset_state);
 
-static int dst_i2c_enable(struct dst_state *state)
+int rdc_8820_reset(struct dst_state *state)
 {
-        int retval;
-        /* pull I2C enable gpio pin low, wait */
-        // dprintk ("%s: i2c enable\n", __FUNCTION__);
-        retval = dst_gpio_outb(state, ~0, DST_I2C_ENABLE, 0);
-        if (retval < 0)
-                return retval;
-        // dprintk ("%s: i2c enable delay\n", __FUNCTION__);
-        msleep(33);
+        if (verbose > 1)
+                dprintk("%s: Resetting DST\n", __FUNCTION__);
+
+        if (dst_gpio_outb(state, RDC_8820_RESET, RDC_8820_RESET, 0, NO_DELAY) < 0) {
+                dprintk("%s: dst_gpio_outb ERROR !\n", __FUNCTION__);
+                return -1;
+        }
+        udelay(1000);
+        if (dst_gpio_outb(state, RDC_8820_RESET, RDC_8820_RESET, RDC_8820_RESET, DELAY) < 0) {
+                dprintk("%s: dst_gpio_outb ERROR !\n", __FUNCTION__);
+                return -1;
+        }
+
         return 0;
 }
+EXPORT_SYMBOL(rdc_8820_reset);
 
-static int dst_i2c_disable(struct dst_state *state)
+int dst_pio_enable(struct dst_state *state)
 {
-        int retval;
-        /* release I2C enable gpio pin, wait */
-        // dprintk ("%s: i2c disable\n", __FUNCTION__);
-        retval = dst_gpio_outb(state, ~0, 0, 0);
-        if (retval < 0)
-                return retval;
-        // dprintk ("%s: i2c disable delay\n", __FUNCTION__);
-        msleep(33);
+        if (dst_gpio_outb(state, ~0, RDC_8820_PIO_0_ENABLE, 0, NO_DELAY) < 0) {
+                dprintk("%s: dst_gpio_outb ERROR !\n", __FUNCTION__);
+                return -1;
+        }
+        udelay(1000);
+        return 0;
+}
+EXPORT_SYMBOL(dst_pio_enable);
+
+int dst_pio_disable(struct dst_state *state)
+{
+        if (dst_gpio_outb(state, ~0, RDC_8820_PIO_0_DISABLE, RDC_8820_PIO_0_DISABLE, NO_DELAY) < 0) {
+                dprintk("%s: dst_gpio_outb ERROR !\n", __FUNCTION__);
+                return -1;
+        }
+        if (state->type_flags & DST_TYPE_HAS_FW_1)
+                udelay(1000);
+
         return 0;
 }
+EXPORT_SYMBOL(dst_pio_disable);
 
-static int dst_wait_dst_ready(struct dst_state *state)
+int dst_wait_dst_ready(struct dst_state *state, u8 delay_mode)
 {
         u8 reply;
-        int retval;
         int i;
+
         for (i = 0; i < 200; i++) {
-                retval = dst_gpio_inb(state, &reply);
-                if (retval < 0)
-                        return retval;
-                if ((reply & DST_I2C_ENABLE) == 0) {
-                        dprintk("%s: dst wait ready after %d\n", __FUNCTION__, i);
+                if (dst_gpio_inb(state, &reply) < 0) {
+                        dprintk("%s: dst_gpio_inb ERROR !\n", __FUNCTION__);
+                        return -1;
+                }
+
+                if ((reply & RDC_8820_PIO_0_ENABLE) == 0) {
+                        if (verbose > 4)
+                                dprintk("%s: dst wait ready after %d\n", __FUNCTION__, i);
                         return 1;
                 }
                 msleep(10);
         }
-        dprintk("%s: dst wait NOT ready after %d\n", __FUNCTION__, i);
+        if (verbose > 1)
+                dprintk("%s: dst wait NOT ready after %d\n", __FUNCTION__, i);
+
+        return 0;
+}
+EXPORT_SYMBOL(dst_wait_dst_ready);
+
+int dst_error_recovery(struct dst_state *state)
+{
+        dprintk("%s: Trying to return from previous errors...\n", __FUNCTION__);
+        dst_pio_disable(state);
+        msleep(10);
+        dst_pio_enable(state);
+        msleep(10);
+
+        return 0;
+}
+EXPORT_SYMBOL(dst_error_recovery);
+
+int dst_error_bailout(struct dst_state *state)
+{
+        dprintk("%s: Trying to bailout from previous error...\n", __FUNCTION__);
+        rdc_8820_reset(state);
+        dst_pio_disable(state);
+        msleep(10);
+
+        return 0;
+}
+EXPORT_SYMBOL(dst_error_bailout);
+
+
+int dst_comm_init(struct dst_state* state)
+{
+        if (verbose > 1)
+                dprintk ("%s: Initializing DST..\n", __FUNCTION__);
+        if ((dst_pio_enable(state)) < 0) {
+                dprintk("%s: PIO Enable Failed.\n", __FUNCTION__);
+                return -1;
+        }
+        if ((rdc_reset_state(state)) < 0) {
+                dprintk("%s: RDC 8820 State RESET Failed.\n", __FUNCTION__);
+                return -1;
+        }
+        if (state->type_flags & DST_TYPE_HAS_FW_1)
+                msleep(100);
+        else
+                msleep(5);
+
         return 0;
 }
+EXPORT_SYMBOL(dst_comm_init);
 
-static int write_dst(struct dst_state *state, u8 * data, u8 len)
+
+int write_dst(struct dst_state *state, u8 *data, u8 len)
 {
         struct i2c_msg msg = {
                 .addr = state->config->demod_address,.flags = 0,.buf = data,.len = len
         };
+
         int err;
         int cnt;
-
-        if (dst_debug && dst_verbose) {
+        if (debug && (verbose > 4)) {
                 u8 i;
-                dprintk("%s writing", __FUNCTION__);
-                for (i = 0; i < len; i++) {
-                        dprintk(" 0x%02x", data[i]);
+                if (verbose > 4) {
+                        dprintk("%s writing", __FUNCTION__);
+                        for (i = 0; i < len; i++)
+                                dprintk(" %02x", data[i]);
+                        dprintk("\n");
                 }
-                dprintk("\n");
         }
-        msleep(30);
-        for (cnt = 0; cnt < 4; cnt++) {
+        for (cnt = 0; cnt < 2; cnt++) {
                 if ((err = i2c_transfer(state->i2c, &msg, 1)) < 0) {
-                        dprintk("%s: write_dst error (err == %i, len == 0x%02x, b0 == 0x%02x)\n", __FUNCTION__, err, len, data[0]);
-                        dst_i2c_disable(state);
-                        msleep(500);
-                        dst_i2c_enable(state);
-                        msleep(500);
+                        dprintk("%s: _write_dst error (err == %i, len == 0x%02x, b0 == 0x%02x)\n", __FUNCTION__, err, len, data[0]);
+                        dst_error_recovery(state);
                         continue;
                 } else
                         break;
         }
-        if (cnt >= 4)
-                return -EREMOTEIO;
+
+        if (cnt >= 2) {
+                if (verbose > 1)
+                        printk("%s: RDC 8820 RESET...\n", __FUNCTION__);
+                dst_error_bailout(state);
+
+                return -1;
+        }
+
         return 0;
 }
+EXPORT_SYMBOL(write_dst);
 
-static int read_dst(struct dst_state *state, u8 * ret, u8 len)
+int read_dst(struct dst_state *state, u8 * ret, u8 len)
 {
         struct i2c_msg msg = {.addr = state->config->demod_address,.flags = I2C_M_RD,.buf = ret,.len = len };
         int err;
         int cnt;
 
-        for (cnt = 0; cnt < 4; cnt++) {
+        for (cnt = 0; cnt < 2; cnt++) {
                 if ((err = i2c_transfer(state->i2c, &msg, 1)) < 0) {
+
                         dprintk("%s: read_dst error (err == %i, len == 0x%02x, b0 == 0x%02x)\n", __FUNCTION__, err, len, ret[0]);
-                        dst_i2c_disable(state);
-                        dst_i2c_enable(state);
+                        dst_error_recovery(state);
+
                         continue;
                 } else
                         break;
         }
-        if (cnt >= 4)
-                return -EREMOTEIO;
-        dprintk("%s reply is 0x%x\n", __FUNCTION__, ret[0]);
-        if (dst_debug && dst_verbose) {
+        if (cnt >= 2) {
+                if (verbose > 1)
+                        printk("%s: RDC 8820 RESET...\n", __FUNCTION__);
+                dst_error_bailout(state);
+
+                return -1;
+        }
+        if (debug && (verbose > 4)) {
+                dprintk("%s reply is 0x%x\n", __FUNCTION__, ret[0]);
                 for (err = 1; err < len; err++)
                         dprintk(" 0x%x", ret[err]);
                 if (err > 1)
                         dprintk("\n");
         }
+
         return 0;
 }
+EXPORT_SYMBOL(read_dst);
 
 static int dst_set_freq(struct dst_state *state, u32 freq)
 {
         u8 *val;
 
         state->frequency = freq;
+        if (debug > 4)
+                dprintk("%s: set Frequency %u\n", __FUNCTION__, freq);
 
-        // dprintk("%s: set frequency %u\n", __FUNCTION__, freq);
         if (state->dst_type == DST_TYPE_IS_SAT) {
                 freq = freq / 1000;
                 if (freq < 950 || freq > 2150)
@@ -398,7 +450,8 @@ static int dst_set_symbolrate(struct dst_state* state, u32 srate)
         if (state->dst_type == DST_TYPE_IS_TERR) {
                 return 0;
         }
-        // dprintk("%s: set srate %u\n", __FUNCTION__, srate);
+        if (debug > 4)
+                dprintk("%s: set symrate %u\n", __FUNCTION__, srate);
         srate /= 1000;
         val = &state->tx_tuna[0];
 
@@ -407,7 +460,10 @@ static int dst_set_symbolrate(struct dst_state* state, u32 srate)
                 sval <<= 20;
                 do_div(sval, 88000);
                 symcalc = (u32) sval;
-                // dprintk("%s: set symcalc %u\n", __FUNCTION__, symcalc);
+
+                if (debug > 4)
+                        dprintk("%s: set symcalc %u\n", __FUNCTION__, symcalc);
+
                 val[5] = (u8) (symcalc >> 12);
                 val[6] = (u8) (symcalc >> 4);
                 val[7] = (u8) (symcalc << 4);
@@ -422,7 +478,7 @@ static int dst_set_symbolrate(struct dst_state* state, u32 srate)
         return 0;
 }
 
-static u8 dst_check_sum(u8 * buf, u32 len)
+u8 dst_check_sum(u8 * buf, u32 len)
 {
         u32 i;
         u8 val = 0;
@@ -433,28 +489,7 @@ static u8 dst_check_sum(u8 * buf, u32 len)
         }
         return ((~val) + 1);
 }
-
-struct dst_types {
-        char *mstr;
-        int offs;
-        u8 dst_type;
-        u32 type_flags;
-};
-
-static struct dst_types dst_tlist[] = {
-        {"DST-020", 0, DST_TYPE_IS_SAT, DST_TYPE_HAS_SYMDIV},
-        {"DST-030", 0, DST_TYPE_IS_SAT, DST_TYPE_HAS_TS204 | DST_TYPE_HAS_NEWTUNE},
-        {"DST-03T", 0, DST_TYPE_IS_SAT, DST_TYPE_HAS_SYMDIV | DST_TYPE_HAS_TS204},
-        {"DST-MOT", 0, DST_TYPE_IS_SAT, DST_TYPE_HAS_SYMDIV},
-        {"DST-CI",  1, DST_TYPE_IS_SAT, DST_TYPE_HAS_TS204 | DST_TYPE_HAS_NEWTUNE},
-        {"DSTMCI",  1, DST_TYPE_IS_SAT, DST_TYPE_HAS_NEWTUNE},
-        {"DSTFCI",  1, DST_TYPE_IS_SAT, DST_TYPE_HAS_NEWTUNE},
-        {"DCTNEW",  1, DST_TYPE_IS_CABLE, DST_TYPE_HAS_NEWTUNE},
-        {"DCT-CI",  1, DST_TYPE_IS_CABLE, DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_TS204},
-        {"DTTDIG",  1, DST_TYPE_IS_TERR, 0}
-};
-
-/* DCTNEW and DCT-CI are guesses */
+EXPORT_SYMBOL(dst_check_sum);
 
 static void dst_type_flags_print(u32 type_flags)
 {
@@ -465,93 +500,270 @@ static void dst_type_flags_print(u32 type_flags)
                 printk(" 0x%x ts204", DST_TYPE_HAS_TS204);
         if (type_flags & DST_TYPE_HAS_SYMDIV)
                 printk(" 0x%x symdiv", DST_TYPE_HAS_SYMDIV);
+        if (type_flags & DST_TYPE_HAS_FW_1)
+                printk(" 0x%x firmware version = 1", DST_TYPE_HAS_FW_1);
+        if (type_flags & DST_TYPE_HAS_FW_2)
+                printk(" 0x%x firmware version = 2", DST_TYPE_HAS_FW_2);
+        if (type_flags & DST_TYPE_HAS_FW_3)
+                printk(" 0x%x firmware version = 3", DST_TYPE_HAS_FW_3);
+//      if ((type_flags & DST_TYPE_HAS_FW_BUILD) && new_fw)
+
         printk("\n");
 }
 
-static int dst_type_print(u8 type)
+
+static int dst_type_print (u8 type)
 {
         char *otype;
         switch (type) {
         case DST_TYPE_IS_SAT:
                 otype = "satellite";
                 break;
+
         case DST_TYPE_IS_TERR:
                 otype = "terrestrial";
                 break;
+
         case DST_TYPE_IS_CABLE:
                 otype = "cable";
                 break;
+
         default:
                 printk("%s: invalid dst type %d\n", __FUNCTION__, type);
                 return -EINVAL;
         }
         printk("DST type : %s\n", otype);
+
         return 0;
 }
 
-static int dst_check_ci(struct dst_state *state)
+/*
+        Known cards list
+        Satellite
+        -------------------
+                  200103A
+        VP-1020   DST-MOT       LG(old), TS=188
+
+        VP-1020   DST-03T       LG(new), TS=204
+        VP-1022   DST-03T       LG(new), TS=204
+        VP-1025   DST-03T       LG(new), TS=204
+
+        VP-1030   DSTMCI,       LG(new), TS=188
+        VP-1032   DSTMCI,       LG(new), TS=188
+
+        Cable
+        -------------------
+        VP-2030   DCT-CI,       Samsung, TS=204
+        VP-2021   DCT-CI,       Unknown, TS=204
+        VP-2031   DCT-CI,       Philips, TS=188
+        VP-2040   DCT-CI,       Philips, TS=188, with CA daughter board
+        VP-2040   DCT-CI,       Philips, TS=204, without CA daughter board
+
+        Terrestrial
+        -------------------
+        VP-3050  DTTNXT                  TS=188
+        VP-3040  DTT-CI,        Philips, TS=188
+        VP-3040  DTT-CI,        Philips, TS=204
+
+        ATSC
+        -------------------
+        VP-3220  ATSCDI,                 TS=188
+        VP-3250  ATSCAD,                 TS=188
+
+*/
+
+struct dst_types dst_tlist[] = {
+        {
+                .device_id = "200103A",
+                .offset = 0,
+                .dst_type =  DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_SYMDIV | DST_TYPE_HAS_FW_1,
+                .dst_feature = 0
+        },      /*      obsolete        */
+
+        {
+                .device_id = "DST-020",
+                .offset = 0,
+                .dst_type =  DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_SYMDIV | DST_TYPE_HAS_FW_1,
+                .dst_feature = 0
+        },      /*      obsolete        */
+
+        {
+                .device_id = "DST-030",
+                .offset =  0,
+                .dst_type = DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_TS204 | DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_FW_1,
+                .dst_feature = 0
+        },      /*      obsolete        */
+
+        {
+                .device_id = "DST-03T",
+                .offset = 0,
+                .dst_type = DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_SYMDIV | DST_TYPE_HAS_TS204 | DST_TYPE_HAS_FW_2,
+                .dst_feature = DST_TYPE_HAS_DISEQC3 | DST_TYPE_HAS_DISEQC4 | DST_TYPE_HAS_DISEQC5
+                                                         | DST_TYPE_HAS_MAC | DST_TYPE_HAS_MOTO
+         },
+
+        {
+                .device_id = "DST-MOT",
+                .offset =  0,
+                .dst_type = DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_SYMDIV | DST_TYPE_HAS_FW_1,
+                .dst_feature = 0
+        },      /*      obsolete        */
+
+        {
+                .device_id = "DST-CI",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_TS204 | DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_FW_1,
+                .dst_feature = DST_TYPE_HAS_CA
+        },      /*      An OEM board    */
+
+        {
+                .device_id = "DSTMCI",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_FW_2 | DST_TYPE_HAS_FW_BUILD,
+                .dst_feature = DST_TYPE_HAS_CA | DST_TYPE_HAS_DISEQC3 | DST_TYPE_HAS_DISEQC4
+                                                        | DST_TYPE_HAS_MOTO | DST_TYPE_HAS_MAC
+        },
+
+        {
+                .device_id = "DSTFCI",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_SAT,
+                .type_flags = DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_FW_1,
+                .dst_feature = 0
+        },      /* unknown to vendor    */
+
+        {
+                .device_id = "DCT-CI",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_CABLE,
+                .type_flags = DST_TYPE_HAS_TS204 | DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_FW_1
+                                                        | DST_TYPE_HAS_FW_2 | DST_TYPE_HAS_FW_BUILD,
+                .dst_feature = DST_TYPE_HAS_CA
+        },
+
+        {
+                .device_id = "DCTNEW",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_CABLE,
+                .type_flags = DST_TYPE_HAS_NEWTUNE | DST_TYPE_HAS_FW_3,
+                .dst_feature = 0
+        },
+
+        {
+                .device_id = "DTT-CI",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_TERR,
+                .type_flags = DST_TYPE_HAS_TS204 | DST_TYPE_HAS_FW_2 | DST_TYPE_HAS_FW_BUILD,
+                .dst_feature = 0
+        },
+
+        {
+                .device_id = "DTTDIG",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_TERR,
+                .type_flags = DST_TYPE_HAS_FW_2,
+                .dst_feature = 0
+        },
+
+        {
+                .device_id = "DTTNXT",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_TERR,
+                .type_flags = DST_TYPE_HAS_FW_2,
+                .dst_feature = DST_TYPE_HAS_ANALOG
+        },
+
+        {
+                .device_id = "ATSCDI",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_ATSC,
+                .type_flags = DST_TYPE_HAS_FW_2,
+                .dst_feature = 0
+        },
+
+        {
+                .device_id = "ATSCAD",
+                .offset = 1,
+                .dst_type = DST_TYPE_IS_ATSC,
+                .type_flags = DST_TYPE_HAS_FW_2,
+                .dst_feature = 0
+        },
+
+        { }
+
+};
+
+
+static int dst_get_device_id(struct dst_state *state)
 {
-        u8 txbuf[8];
-        u8 rxbuf[8];
-        int retval;
+        u8 reply;
+
         int i;
-        struct dst_types *dsp;
-        u8 use_dst_type;
-        u32 use_type_flags;
+        struct dst_types *p_dst_type;
+        u8 use_dst_type = 0;
+        u32 use_type_flags = 0;
 
-        memset(txbuf, 0, sizeof(txbuf));
-        txbuf[1] = 6;
-        txbuf[7] = dst_check_sum(txbuf, 7);
+        static u8 device_type[8] = {0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff};
 
-        dst_i2c_enable(state);
-        dst_reset8820(state);
-        retval = write_dst(state, txbuf, 8);
-        if (retval < 0) {
-                dst_i2c_disable(state);
-                dprintk("%s: write not successful, maybe no card?\n", __FUNCTION__);
-                return retval;
-        }
-        msleep(3);
-        retval = read_dst(state, rxbuf, 1);
-        dst_i2c_disable(state);
-        if (retval < 0) {
-                dprintk("%s: read not successful, maybe no card?\n", __FUNCTION__);
-                return retval;
-        }
-        if (rxbuf[0] != 0xff) {
-                dprintk("%s: write reply not 0xff, not ci (%02x)\n", __FUNCTION__, rxbuf[0]);
-                return retval;
-        }
-        if (!dst_wait_dst_ready(state))
-                return 0;
-        // dst_i2c_enable(i2c); Dimitri
-        retval = read_dst(state, rxbuf, 8);
-        dst_i2c_disable(state);
-        if (retval < 0) {
-                dprintk("%s: read not successful\n", __FUNCTION__);
-                return retval;
+        device_type[7] = dst_check_sum(device_type, 7);
+
+        if (write_dst(state, device_type, FIXED_COMM))
+                return -1;              /*      Write failed            */
+
+        if ((dst_pio_disable(state)) < 0)
+                return -1;
+
+        if (read_dst(state, &reply, GET_ACK))
+                return -1;              /*      Read failure            */
+
+        if (reply != ACK) {
+                dprintk("%s: Write not Acknowledged! [Reply=0x%02x]\n", __FUNCTION__, reply);
+                return -1;              /*      Unack'd write           */
         }
-        if (rxbuf[7] != dst_check_sum(rxbuf, 7)) {
-                dprintk("%s: checksum failure\n", __FUNCTION__);
-                return retval;
+
+        if (!dst_wait_dst_ready(state, DEVICE_INIT))
+                return -1;              /*      DST not ready yet       */
+
+        if (read_dst(state, state->rxbuffer, FIXED_COMM))
+                return -1;
+
+        dst_pio_disable(state);
+
+        if (state->rxbuffer[7] != dst_check_sum(state->rxbuffer, 7)) {
+                dprintk("%s: Checksum failure! \n", __FUNCTION__);
+                return -1;              /*      Checksum failure        */
         }
-        rxbuf[7] = '\0';
-        for (i = 0, dsp = &dst_tlist[0]; i < sizeof(dst_tlist) / sizeof(dst_tlist[0]); i++, dsp++) {
-                if (!strncmp(&rxbuf[dsp->offs], dsp->mstr, strlen(dsp->mstr))) {
-                        use_type_flags = dsp->type_flags;
-                        use_dst_type = dsp->dst_type;
-                        printk("%s: recognize %s\n", __FUNCTION__, dsp->mstr);
+
+        state->rxbuffer[7] = '\0';
+
+        for (i = 0, p_dst_type = dst_tlist; i < ARRAY_SIZE (dst_tlist); i++, p_dst_type++) {
+                if (!strncmp (&state->rxbuffer[p_dst_type->offset], p_dst_type->device_id, strlen (p_dst_type->device_id))) {
+                        use_type_flags = p_dst_type->type_flags;
+                        use_dst_type = p_dst_type->dst_type;
+
+                        /*      Card capabilities       */
+                        state->dst_hw_cap = p_dst_type->dst_feature;
+                        printk ("%s: Recognise [%s]\n", __FUNCTION__, p_dst_type->device_id);
+
                         break;
                 }
         }
-        if (i >= sizeof(dst_tlist) / sizeof(dst_tlist[0])) {
-                printk("%s: unable to recognize %s or %s\n", __FUNCTION__, &rxbuf[0], &rxbuf[1]);
-                printk("%s please email linux-dvb@linuxtv.org with this type in\n", __FUNCTION__);
+
+        if (i >= sizeof (dst_tlist) / sizeof (dst_tlist [0])) {
+                printk("%s: Unable to recognize %s or %s\n", __FUNCTION__, &state->rxbuffer[0], &state->rxbuffer[1]);
+                printk("%s: please email linux-dvb@linuxtv.org with this type in\n", __FUNCTION__);
                 use_dst_type = DST_TYPE_IS_SAT;
                 use_type_flags = DST_TYPE_HAS_SYMDIV;
         }
-        dst_type_print(use_dst_type);
 
+        dst_type_print(use_dst_type);
         state->type_flags = use_type_flags;
         state->dst_type = use_dst_type;
         dst_type_flags_print(state->type_flags);
@@ -559,50 +771,102 @@ static int dst_check_ci(struct dst_state *state)
         if (state->type_flags & DST_TYPE_HAS_TS204) {
                 dst_packsize(state, 204);
         }
+
         return 0;
 }
 
-static int dst_command(struct dst_state* state, u8 * data, u8 len)
+static int dst_probe(struct dst_state *state)
+{
+        if ((rdc_8820_reset(state)) < 0) {
+                dprintk("%s: RDC 8820 RESET Failed.\n", __FUNCTION__);
+                return -1;
+        }
+        if (dst_addons & DST_TYPE_HAS_CA)
+                msleep(4000);
+        else
+                msleep(100);
+
+        if ((dst_comm_init(state)) < 0) {
+                dprintk("%s: DST Initialization Failed.\n", __FUNCTION__);
+                return -1;
+        }
+        msleep(100);
+        if (dst_get_device_id(state) < 0) {
+                dprintk("%s: unknown device.\n", __FUNCTION__);
+                return -1;
+        }
+
+        return 0;
+}
+
+int dst_command(struct dst_state* state, u8 * data, u8 len)
 {
-        int retval;
         u8 reply;
+        if ((dst_comm_init(state)) < 0) {
+                dprintk("%s: DST Communication Initialization Failed.\n", __FUNCTION__);
+                return -1;
+        }
 
-        dst_i2c_enable(state);
-        dst_reset8820(state);
-        retval = write_dst(state, data, len);
-        if (retval < 0) {
-                dst_i2c_disable(state);
-                dprintk("%s: write not successful\n", __FUNCTION__);
-                return retval;
+        if (write_dst(state, data, len)) {
+                if (verbose > 1)
+                        dprintk("%s: Tring to recover.. \n", __FUNCTION__);
+                if ((dst_error_recovery(state)) < 0) {
+                        dprintk("%s: Recovery Failed.\n", __FUNCTION__);
+                        return -1;
+                }
+                return -1;
         }
-        msleep(33);
-        retval = read_dst(state, &reply, 1);
-        dst_i2c_disable(state);
-        if (retval < 0) {
-                dprintk("%s: read verify  not successful\n", __FUNCTION__);
-                return retval;
+        if ((dst_pio_disable(state)) < 0) {
+                dprintk("%s: PIO Disable Failed.\n", __FUNCTION__);
+                return -1;
         }
-        if (reply != 0xff) {
-                dprintk("%s: write reply not 0xff 0x%02x \n", __FUNCTION__, reply);
-                return 0;
+        if (state->type_flags & DST_TYPE_HAS_FW_1)
+                udelay(3000);
+
+        if (read_dst(state, &reply, GET_ACK)) {
+                if (verbose > 1)
+                        dprintk("%s: Trying to recover.. \n", __FUNCTION__);
+                if ((dst_error_recovery(state)) < 0) {
+                        dprintk("%s: Recovery Failed.\n", __FUNCTION__);
+                        return -1;
+                }
+                return -1;
+        }
+
+        if (reply != ACK) {
+                dprintk("%s: write not acknowledged 0x%02x \n", __FUNCTION__, reply);
+                return -1;
         }
         if (len >= 2 && data[0] == 0 && (data[1] == 1 || data[1] == 3))
                 return 0;
-        if (!dst_wait_dst_ready(state))
-                return 0;
-        // dst_i2c_enable(i2c); Per dimitri
-        retval = read_dst(state, state->rxbuffer, 8);
-        dst_i2c_disable(state);
-        if (retval < 0) {
-                dprintk("%s: read not successful\n", __FUNCTION__);
-                return 0;
+
+//      udelay(3000);
+        if (state->type_flags & DST_TYPE_HAS_FW_1)
+                udelay(3000);
+        else
+                udelay(2000);
+
+        if (!dst_wait_dst_ready(state, NO_DELAY))
+                return -1;
+
+        if (read_dst(state, state->rxbuffer, FIXED_COMM)) {
+                if (verbose > 1)
+                        dprintk("%s: Trying to recover.. \n", __FUNCTION__);
+                if ((dst_error_recovery(state)) < 0) {
+                        dprintk("%s: Recovery failed.\n", __FUNCTION__);
+                        return -1;
+                }
+                return -1;
         }
+
         if (state->rxbuffer[7] != dst_check_sum(state->rxbuffer, 7)) {
                 dprintk("%s: checksum failure\n", __FUNCTION__);
-                return 0;
+                return -1;
         }
+
         return 0;
 }
+EXPORT_SYMBOL(dst_command);
 
 static int dst_get_signal(struct dst_state* state)
 {
@@ -646,11 +910,17 @@ static int dst_tone_power_cmd(struct dst_state* state)
                 paket[4] = 0;
         else
                 paket[4] = 1;
+
         if (state->tone == SEC_TONE_ON)
-                paket[2] = state->k22;
+                paket[2] = 0x02;
         else
                 paket[2] = 0;
-        paket[7] = dst_check_sum(&paket[0], 7);
+        if (state->minicmd == SEC_MINI_A)
+                paket[3] = 0x02;
+        else
+                paket[3] = 0;
+
+        paket[7] = dst_check_sum (paket, 7);
         dst_command(state, paket, 8);
         return 0;
 }
@@ -658,21 +928,26 @@ static int dst_tone_power_cmd(struct dst_state* state)
 static int dst_get_tuna(struct dst_state* state)
 {
         int retval;
+
         if ((state->diseq_flags & ATTEMPT_TUNE) == 0)
                 return 0;
+
         state->diseq_flags &= ~(HAS_LOCK);
-        if (!dst_wait_dst_ready(state))
+        if (!dst_wait_dst_ready(state, NO_DELAY))
                 return 0;
+
         if (state->type_flags & DST_TYPE_HAS_NEWTUNE) {
                 /* how to get variable length reply ???? */
                 retval = read_dst(state, state->rx_tuna, 10);
         } else {
-                retval = read_dst(state, &state->rx_tuna[2], 8);
+                retval = read_dst(state, &state->rx_tuna[2], FIXED_COMM);
         }
+
         if (retval < 0) {
                 dprintk("%s: read not successful\n", __FUNCTION__);
                 return 0;
         }
+
         if (state->type_flags & DST_TYPE_HAS_NEWTUNE) {
                 if (state->rx_tuna[9] != dst_check_sum(&state->rx_tuna[0], 9)) {
                         dprintk("%s: checksum failure?\n", __FUNCTION__);
@@ -709,7 +984,9 @@ static int dst_write_tuna(struct dvb_frontend* fe)
         int retval;
         u8 reply;
 
-        dprintk("%s: type_flags 0x%x \n", __FUNCTION__, state->type_flags);
+        if (debug > 4)
+                dprintk("%s: type_flags 0x%x \n", __FUNCTION__, state->type_flags);
+
         state->decode_freq = 0;
         state->decode_lock = state->decode_strength = state->decode_snr = 0;
         if (state->dst_type == DST_TYPE_IS_SAT) {
@@ -717,32 +994,41 @@ static int dst_write_tuna(struct dvb_frontend* fe)
                         dst_set_voltage(fe, SEC_VOLTAGE_13);
         }
         state->diseq_flags &= ~(HAS_LOCK | ATTEMPT_TUNE);
-        dst_i2c_enable(state);
+
+        if ((dst_comm_init(state)) < 0) {
+                dprintk("%s: DST Communication initialization failed.\n", __FUNCTION__);
+                return -1;
+        }
+
         if (state->type_flags & DST_TYPE_HAS_NEWTUNE) {
-                dst_reset8820(state);
                 state->tx_tuna[9] = dst_check_sum(&state->tx_tuna[0], 9);
                 retval = write_dst(state, &state->tx_tuna[0], 10);
+
         } else {
                 state->tx_tuna[9] = dst_check_sum(&state->tx_tuna[2], 7);
-                retval = write_dst(state, &state->tx_tuna[2], 8);
+                retval = write_dst(state, &state->tx_tuna[2], FIXED_COMM);
         }
         if (retval < 0) {
-                dst_i2c_disable(state);
+                dst_pio_disable(state);
                 dprintk("%s: write not successful\n", __FUNCTION__);
                 return retval;
         }
-        msleep(3);
-        retval = read_dst(state, &reply, 1);
-        dst_i2c_disable(state);
-        if (retval < 0) {
-                dprintk("%s: read verify  not successful\n", __FUNCTION__);
-                return retval;
+
+        if ((dst_pio_disable(state)) < 0) {
+                dprintk("%s: DST PIO disable failed !\n", __FUNCTION__);
+                return -1;
+        }
+
+        if ((read_dst(state, &reply, GET_ACK) < 0)) {
+                dprintk("%s: read verify not successful.\n", __FUNCTION__);
+                return -1;
         }
-        if (reply != 0xff) {
-                dprintk("%s: write reply not 0xff 0x%02x \n", __FUNCTION__, reply);
+        if (reply != ACK) {
+                dprintk("%s: write not acknowledged 0x%02x \n", __FUNCTION__, reply);
                 return 0;
         }
         state->diseq_flags |= ATTEMPT_TUNE;
+
         return dst_get_tuna(state);
 }
 
@@ -796,22 +1082,25 @@ static int dst_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t voltage)
                         need_cmd = 1;
                 state->diseq_flags |= HAS_POWER;
                 break;
+
         case SEC_VOLTAGE_18:
                 if ((state->diseq_flags & HAS_POWER) == 0)
                         need_cmd = 1;
                 state->diseq_flags |= HAS_POWER;
                 val[8] |= 0x40;
                 break;
+
         case SEC_VOLTAGE_OFF:
                 need_cmd = 1;
                 state->diseq_flags &= ~(HAS_POWER | HAS_LOCK | ATTEMPT_TUNE);
                 break;
+
         default:
                 return -EINVAL;
         }
-        if (need_cmd) {
+        if (need_cmd)
                 dst_tone_power_cmd(state);
-        }
+
         return 0;
 }
 
@@ -832,13 +1121,16 @@ static int dst_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
         switch (tone) {
         case SEC_TONE_OFF:
                 break;
+
         case SEC_TONE_ON:
                 val[8] |= 1;
                 break;
+
         default:
                 return -EINVAL;
         }
         dst_tone_power_cmd(state);
+
         return 0;
 }
 
@@ -913,10 +1205,16 @@ static int dst_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_paramet
         struct dst_state* state = (struct dst_state*) fe->demodulator_priv;
 
         dst_set_freq(state, p->frequency);
+        if (verbose > 4)
+                dprintk("Set Frequency = [%d]\n", p->frequency);
+
         dst_set_inversion(state, p->inversion);
         if (state->dst_type == DST_TYPE_IS_SAT) {
                 dst_set_fec(state, p->u.qpsk.fec_inner);
                 dst_set_symbolrate(state, p->u.qpsk.symbol_rate);
+                if (verbose > 4)
+                        dprintk("Set Symbolrate = [%d]\n", p->u.qpsk.symbol_rate);
+
         } else if (state->dst_type == DST_TYPE_IS_TERR) {
                 dst_set_bandwidth(state, p->u.ofdm.bandwidth);
         } else if (state->dst_type == DST_TYPE_IS_CABLE) {
@@ -958,50 +1256,47 @@ static struct dvb_frontend_ops dst_dvbt_ops;
 static struct dvb_frontend_ops dst_dvbs_ops;
 static struct dvb_frontend_ops dst_dvbc_ops;
 
-struct dvb_frontend* dst_attach(const struct dst_config* config,
-                                struct i2c_adapter* i2c,
-                                struct bt878 *bt)
+struct dst_state* dst_attach(struct dst_state *state, struct dvb_adapter *dvb_adapter)
 {
-        struct dst_state* state = NULL;
-
-        /* allocate memory for the internal state */
-        state = (struct dst_state*) kmalloc(sizeof(struct dst_state), GFP_KERNEL);
-        if (state == NULL) goto error;
 
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        state->bt = bt;
-
-        /* check if the demod is there */
-        if (dst_check_ci(state) < 0) goto error;
+        /* check if the ASIC is there */
+        if (dst_probe(state) < 0) {
+                if (state)
+                        kfree(state);
 
+                return NULL;
+        }
         /* determine settings based on type */
         switch (state->dst_type) {
         case DST_TYPE_IS_TERR:
                 memcpy(&state->ops, &dst_dvbt_ops, sizeof(struct dvb_frontend_ops));
                 break;
+
         case DST_TYPE_IS_CABLE:
                 memcpy(&state->ops, &dst_dvbc_ops, sizeof(struct dvb_frontend_ops));
                 break;
+
         case DST_TYPE_IS_SAT:
                 memcpy(&state->ops, &dst_dvbs_ops, sizeof(struct dvb_frontend_ops));
                 break;
+
         default:
-                printk("dst: unknown frontend type. please report to the LinuxTV.org DVB mailinglist.\n");
-                goto error;
+                printk("%s: unknown DST type. please report to the LinuxTV.org DVB mailinglist.\n", __FUNCTION__);
+                if (state)
+                        kfree(state);
+
+                return NULL;
         }
 
         /* create dvb_frontend */
         state->frontend.ops = &state->ops;
         state->frontend.demodulator_priv = state;
-        return &state->frontend;
 
-error:
-        kfree(state);
-        return NULL;
+        return state;                           /*      Manu (DST is a card not a frontend)     */
 }
 
+EXPORT_SYMBOL(dst_attach);
+
 static struct dvb_frontend_ops dst_dvbt_ops = {
 
         .info = {
@@ -1051,6 +1346,7 @@ static struct dvb_frontend_ops dst_dvbs_ops = {
         .read_signal_strength = dst_read_signal_strength,
         .read_snr = dst_read_snr,
 
+        .diseqc_send_burst = dst_set_tone,
         .diseqc_send_master_cmd = dst_set_diseqc,
         .set_voltage = dst_set_voltage,
         .set_tone = dst_set_tone,
@@ -1082,8 +1378,7 @@ static struct dvb_frontend_ops dst_dvbc_ops = {
         .read_snr = dst_read_snr,
 };
 
+
 MODULE_DESCRIPTION("DST DVB-S/T/C Combo Frontend driver");
-MODULE_AUTHOR("Jamie Honan");
+MODULE_AUTHOR("Jamie Honan, Manu Abraham");
 MODULE_LICENSE("GPL");
-
-EXPORT_SYMBOL(dst_attach);
diff --git a/drivers/media/dvb/bt8xx/dst.h b/drivers/media/dvb/bt8xx/dst.h
deleted file mode 100644
index bcb418c5c121..000000000000
--- a/drivers/media/dvb/bt8xx/dst.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
-    Frontend-driver for TwinHan DST Frontend
-
-    Copyright (C) 2003 Jamie Honan
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
-*/
-
-#ifndef DST_H
-#define DST_H
-
-#include <linux/dvb/frontend.h>
-#include <linux/device.h>
-#include "bt878.h"
-
-struct dst_config
-{
-        /* the demodulator's i2c address */
-        u8 demod_address;
-};
-
-extern struct dvb_frontend* dst_attach(const struct dst_config* config,
-                                       struct i2c_adapter* i2c,
-                                       struct bt878 *bt);
-
-#endif // DST_H
diff --git a/drivers/media/dvb/bt8xx/dst_ca.c b/drivers/media/dvb/bt8xx/dst_ca.c
new file mode 100644
index 000000000000..d781504cc2fa
--- /dev/null
+++ b/drivers/media/dvb/bt8xx/dst_ca.c
@@ -0,0 +1,861 @@
+/*
+        CA-driver for TwinHan DST Frontend/Card
+
+        Copyright (C) 2004, 2005 Manu Abraham (manu@kromtek.com)
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the Free Software
+        Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/string.h>
+
+#include <linux/dvb/ca.h>
+#include "dvbdev.h"
+#include "dvb_frontend.h"
+
+#include "dst_ca.h"
+#include "dst_common.h"
+
+static unsigned int verbose = 1;
+module_param(verbose, int, 0644);
+MODULE_PARM_DESC(verbose, "verbose startup messages, default is 1 (yes)");
+
+static unsigned int debug = 1;
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "debug messages, default is 1 (yes)");
+
+#define dprintk if (debug) printk
+
+/*      Need some more work     */
+static int ca_set_slot_descr(void)
+{
+        /*      We could make this more graceful ?      */
+        return -EOPNOTSUPP;
+}
+
+/*      Need some more work     */
+static int ca_set_pid(void)
+{
+        /*      We could make this more graceful ?      */
+        return -EOPNOTSUPP;
+}
+
+
+static int put_checksum(u8 *check_string, int length)
+{
+        u8 i = 0, checksum = 0;
+
+        if (verbose > 3) {
+                dprintk("%s: ========================= Checksum calculation ===========================\n", __FUNCTION__);
+                dprintk("%s: String Length=[0x%02x]\n", __FUNCTION__, length);
+
+                dprintk("%s: String=[", __FUNCTION__);
+        }
+        while (i < length) {
+                if (verbose > 3)
+                        dprintk(" %02x", check_string[i]);
+                checksum += check_string[i];
+                i++;
+        }
+        if (verbose > 3) {
+                dprintk(" ]\n");
+                dprintk("%s: Sum=[%02x]\n", __FUNCTION__, checksum);
+        }
+        check_string[length] = ~checksum + 1;
+        if (verbose > 3) {
+                dprintk("%s: Checksum=[%02x]\n", __FUNCTION__, check_string[length]);
+                dprintk("%s: ==========================================================================\n", __FUNCTION__);
+        }
+
+        return 0;
+}
+
+static int dst_ci_command(struct dst_state* state, u8 * data, u8 *ca_string, u8 len, int read)
+{
+        u8 reply;
+
+        dst_comm_init(state);
+        msleep(65);
+
+        if (write_dst(state, data, len)) {
+                dprintk("%s: Write not successful, trying to recover\n", __FUNCTION__);
+                dst_error_recovery(state);
+                return -1;
+        }
+
+        if ((dst_pio_disable(state)) < 0) {
+                dprintk("%s: DST PIO disable failed.\n", __FUNCTION__);
+                return -1;
+        }
+
+        if (read_dst(state, &reply, GET_ACK) < 0) {
+                dprintk("%s: Read not successful, trying to recover\n", __FUNCTION__);
+                dst_error_recovery(state);
+                return -1;
+        }
+
+        if (read) {
+                if (! dst_wait_dst_ready(state, LONG_DELAY)) {
+                        dprintk("%s: 8820 not ready\n", __FUNCTION__);
+                        return -1;
+                }
+
+                if (read_dst(state, ca_string, 128) < 0) {      /*      Try to make this dynamic        */
+                        dprintk("%s: Read not successful, trying to recover\n", __FUNCTION__);
+                        dst_error_recovery(state);
+                        return -1;
+                }
+        }
+
+        return 0;
+}
+
+
+static int dst_put_ci(struct dst_state *state, u8 *data, int len, u8 *ca_string, int read)
+{
+        u8 dst_ca_comm_err = 0;
+
+        while (dst_ca_comm_err < RETRIES) {
+                dst_comm_init(state);
+                if (verbose > 2)
+                        dprintk("%s: Put Command\n", __FUNCTION__);
+                if (dst_ci_command(state, data, ca_string, len, read)) {        // If error
+                        dst_error_recovery(state);
+                        dst_ca_comm_err++; // work required here.
+                }
+                break;
+        }
+
+        return 0;
+}
+
+
+
+static int ca_get_app_info(struct dst_state *state)
+{
+        static u8 command[8] = {0x07, 0x40, 0x01, 0x00, 0x01, 0x00, 0x00, 0xff};
+
+        put_checksum(&command[0], command[0]);
+        if ((dst_put_ci(state, command, sizeof(command), state->messages, GET_REPLY)) < 0) {
+                dprintk("%s: -->dst_put_ci FAILED !\n", __FUNCTION__);
+                return -1;
+        }
+        if (verbose > 1) {
+                dprintk("%s: -->dst_put_ci SUCCESS !\n", __FUNCTION__);
+
+                dprintk("%s: ================================ CI Module Application Info ======================================\n", __FUNCTION__);
+                dprintk("%s: Application Type=[%d], Application Vendor=[%d], Vendor Code=[%d]\n%s: Application info=[%s]\n",
+                        __FUNCTION__, state->messages[7], (state->messages[8] << 8) | state->messages[9],
+                        (state->messages[10] << 8) | state->messages[11], __FUNCTION__, (char *)(&state->messages[12]));
+                dprintk("%s: ==================================================================================================\n", __FUNCTION__);
+        }
+
+        return 0;
+}
+
+static int ca_get_slot_caps(struct dst_state *state, struct ca_caps *p_ca_caps, void *arg)
+{
+        int i;
+        u8 slot_cap[256];
+        static u8 slot_command[8] = {0x07, 0x40, 0x02, 0x00, 0x02, 0x00, 0x00, 0xff};
+
+        put_checksum(&slot_command[0], slot_command[0]);
+        if ((dst_put_ci(state, slot_command, sizeof (slot_command), slot_cap, GET_REPLY)) < 0) {
+                dprintk("%s: -->dst_put_ci FAILED !\n", __FUNCTION__);
+                return -1;
+        }
+        if (verbose > 1)
+                dprintk("%s: -->dst_put_ci SUCCESS !\n", __FUNCTION__);
+
+        /*      Will implement the rest soon            */
+
+        if (verbose > 1) {
+                dprintk("%s: Slot cap = [%d]\n", __FUNCTION__, slot_cap[7]);
+                dprintk("===================================\n");
+                for (i = 0; i < 8; i++)
+                        dprintk(" %d", slot_cap[i]);
+                dprintk("\n");
+        }
+
+        p_ca_caps->slot_num = 1;
+        p_ca_caps->slot_type = 1;
+        p_ca_caps->descr_num = slot_cap[7];
+        p_ca_caps->descr_type = 1;
+
+
+        if (copy_to_user((struct ca_caps *)arg, p_ca_caps, sizeof (struct ca_caps))) {
+                return -EFAULT;
+        }
+
+        return 0;
+}
+
+/*      Need some more work     */
+static int ca_get_slot_descr(struct dst_state *state, struct ca_msg *p_ca_message, void *arg)
+{
+        return -EOPNOTSUPP;
+}
+
+
+static int ca_get_slot_info(struct dst_state *state, struct ca_slot_info *p_ca_slot_info, void *arg)
+{
+        int i;
+        static u8 slot_command[8] = {0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff};
+
+        u8 *slot_info = state->rxbuffer;
+
+        put_checksum(&slot_command[0], 7);
+        if ((dst_put_ci(state, slot_command, sizeof (slot_command), slot_info, GET_REPLY)) < 0) {
+                dprintk("%s: -->dst_put_ci FAILED !\n", __FUNCTION__);
+                return -1;
+        }
+        if (verbose > 1)
+                dprintk("%s: -->dst_put_ci SUCCESS !\n", __FUNCTION__);
+
+        /*      Will implement the rest soon            */
+
+        if (verbose > 1) {
+                dprintk("%s: Slot info = [%d]\n", __FUNCTION__, slot_info[3]);
+                dprintk("===================================\n");
+                for (i = 0; i < 8; i++)
+                        dprintk(" %d", slot_info[i]);
+                dprintk("\n");
+        }
+
+        if (slot_info[4] & 0x80) {
+                p_ca_slot_info->flags = CA_CI_MODULE_PRESENT;
+                p_ca_slot_info->num = 1;
+                p_ca_slot_info->type = CA_CI;
+        }
+        else if (slot_info[4] & 0x40) {
+                p_ca_slot_info->flags = CA_CI_MODULE_READY;
+                p_ca_slot_info->num = 1;
+                p_ca_slot_info->type = CA_CI;
+        }
+        else {
+                p_ca_slot_info->flags = 0;
+        }
+
+        if (copy_to_user((struct ca_slot_info *)arg, p_ca_slot_info, sizeof (struct ca_slot_info))) {
+                return -EFAULT;
+        }
+
+        return 0;
+}
+
+
+
+
+static int ca_get_message(struct dst_state *state, struct ca_msg *p_ca_message, void *arg)
+{
+        u8 i = 0;
+        u32 command = 0;
+
+        if (copy_from_user(p_ca_message, (void *)arg, sizeof (struct ca_msg)))
+                return -EFAULT;
+
+
+        if (p_ca_message->msg) {
+                if (verbose > 3)
+                        dprintk("Message = [%02x %02x %02x]\n", p_ca_message->msg[0], p_ca_message->msg[1], p_ca_message->msg[2]);
+
+                for (i = 0; i < 3; i++) {
+                        command = command | p_ca_message->msg[i];
+                        if (i < 2)
+                                command = command << 8;
+                }
+                if (verbose > 3)
+                        dprintk("%s:Command=[0x%x]\n", __FUNCTION__, command);
+
+                switch (command) {
+                        case CA_APP_INFO:
+                                memcpy(p_ca_message->msg, state->messages, 128);
+                                if (copy_to_user((void *)arg, p_ca_message, sizeof (struct ca_msg)) )
+                                        return -EFAULT;
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+static int handle_en50221_tag(struct dst_state *state, struct ca_msg *p_ca_message, struct ca_msg *hw_buffer)
+{
+        if (state->dst_hw_cap & DST_TYPE_HAS_SESSION) {
+                hw_buffer->msg[2] = p_ca_message->msg[1];               /*              MSB                     */
+                hw_buffer->msg[3] = p_ca_message->msg[2];               /*              LSB                     */
+        }
+        else {
+                hw_buffer->msg[2] = 0x03;
+                hw_buffer->msg[3] = 0x00;
+        }
+        return 0;
+}
+
+static int debug_8820_buffer(struct ca_msg *hw_buffer)
+{
+        unsigned int i;
+
+        dprintk("%s:Debug=[", __FUNCTION__);
+        for (i = 0; i < (hw_buffer->msg[0] + 1); i++)
+                dprintk(" %02x", hw_buffer->msg[i]);
+        dprintk("]\n");
+
+        return 0;
+}
+
+static int write_to_8820(struct dst_state *state, struct ca_msg *hw_buffer, u8 reply)
+{
+        if ((dst_put_ci(state, hw_buffer->msg, (hw_buffer->length + 1), hw_buffer->msg, reply)) < 0) {
+                dprintk("%s: DST-CI Command failed.\n", __FUNCTION__);
+                dprintk("%s: Resetting DST.\n", __FUNCTION__);
+                rdc_reset_state(state);
+                return -1;
+        }
+        if (verbose > 2)
+                dprintk("%s: DST-CI Command succes.\n", __FUNCTION__);
+
+        return 0;
+}
+
+
+static int ca_set_pmt(struct dst_state *state, struct ca_msg *p_ca_message, struct ca_msg *hw_buffer, u8 reply, u8 query)
+{
+        u32 hw_offset, buf_offset, i, k;
+        u32 program_info_length = 0, es_info_length = 0, length = 0, words = 0;
+        u8 found_prog_ca_desc = 0, found_stream_ca_desc = 0, error_condition = 0, hw_buffer_length = 0;
+
+        if (verbose > 3)
+                dprintk("%s, p_ca_message length %d (0x%x)\n", __FUNCTION__,p_ca_message->length,p_ca_message->length );
+
+        handle_en50221_tag(state, p_ca_message, hw_buffer);                     /*      EN50221 tag             */
+
+        /*      Handle the length field (variable)      */
+        if (!(p_ca_message->msg[3] & 0x80)) {                           /*      Length = 1              */
+                length = p_ca_message->msg[3] & 0x7f;
+                words = 0;                                              /*      domi's suggestion       */
+        }
+        else {                                                          /*      Length = words          */
+                words = p_ca_message->msg[3] & 0x7f;
+                for (i = 0; i < words; i++) {
+                        length = length << 8;
+                        length = length | p_ca_message->msg[4 + i];
+                }
+        }
+        if (verbose > 4) {
+                dprintk("%s:Length=[%d (0x%x)], Words=[%d]\n", __FUNCTION__, length,length, words);
+
+                /*      Debug Input string              */
+                for (i = 0; i < length; i++)
+                        dprintk(" %02x", p_ca_message->msg[i]);
+                dprintk("]\n");
+        }
+
+        hw_offset = 7;
+        buf_offset = words + 4;
+
+        /*              Program Header                  */
+        if (verbose > 4)
+                dprintk("\n%s:Program Header=[", __FUNCTION__);
+        for (i = 0; i < 6; i++) {
+                hw_buffer->msg[hw_offset] = p_ca_message->msg[buf_offset];
+                if (verbose > 4)
+                        dprintk(" %02x", p_ca_message->msg[buf_offset]);
+                hw_offset++, buf_offset++, hw_buffer_length++;
+        }
+        if (verbose > 4)
+                dprintk("]\n");
+
+        program_info_length = 0;
+        program_info_length = (((program_info_length | p_ca_message->msg[words + 8]) & 0x0f) << 8) | p_ca_message->msg[words + 9];
+        if (verbose > 4)
+                dprintk("%s:Program info Length=[%d][%02x], hw_offset=[%d], buf_offset=[%d] \n",
+                        __FUNCTION__, program_info_length, program_info_length, hw_offset, buf_offset);
+
+        if (program_info_length && (program_info_length < 256)) {       /*      If program_info_length          */
+                hw_buffer->msg[11] = hw_buffer->msg[11] & 0x0f;         /*      req only 4 bits                 */
+                hw_buffer->msg[12] = hw_buffer->msg[12] + 1;            /*      increment! ASIC bug!            */
+
+                if (p_ca_message->msg[buf_offset + 1] == 0x09) {        /*      Check CA descriptor             */
+                        found_prog_ca_desc = 1;
+                        if (verbose > 4)
+                                dprintk("%s: Found CA descriptor @ Program level\n", __FUNCTION__);
+                }
+
+                if (found_prog_ca_desc) {                               /*      Command only if CA descriptor   */
+                        hw_buffer->msg[13] = p_ca_message->msg[buf_offset];     /*      CA PMT command ID       */
+                        hw_offset++, buf_offset++, hw_buffer_length++;
+                }
+
+                /*                      Program descriptors                             */
+                if (verbose > 4) {
+                        dprintk("%s:**********>buf_offset=[%d], hw_offset=[%d]\n", __FUNCTION__, buf_offset, hw_offset);
+                        dprintk("%s:Program descriptors=[", __FUNCTION__);
+                }
+                while (program_info_length && !error_condition) {               /*      Copy prog descriptors   */
+                        if (program_info_length > p_ca_message->length) {       /*      Error situation         */
+                                dprintk ("%s:\"WARNING\" Length error, line=[%d], prog_info_length=[%d]\n",
+                                                                __FUNCTION__, __LINE__, program_info_length);
+                                dprintk("%s:\"WARNING\" Bailing out of possible loop\n", __FUNCTION__);
+                                error_condition = 1;
+                                break;
+                        }
+
+                        hw_buffer->msg[hw_offset] = p_ca_message->msg[buf_offset];
+                        dprintk(" %02x", p_ca_message->msg[buf_offset]);
+                        hw_offset++, buf_offset++, hw_buffer_length++, program_info_length--;
+                }
+                if (verbose > 4) {
+                        dprintk("]\n");
+                        dprintk("%s:**********>buf_offset=[%d], hw_offset=[%d]\n", __FUNCTION__, buf_offset, hw_offset);
+                }
+                if (found_prog_ca_desc) {
+                        if (!reply) {
+                                hw_buffer->msg[13] = 0x01;              /*      OK descrambling                 */
+                                if (verbose > 1)
+                                        dprintk("CA PMT Command = OK Descrambling\n");
+                        }
+                        else {
+                                hw_buffer->msg[13] = 0x02;              /*      Ok MMI                          */
+                                if (verbose > 1)
+                                        dprintk("CA PMT Command = Ok MMI\n");
+                        }
+                        if (query) {
+                                hw_buffer->msg[13] = 0x03;              /*      Query                           */
+                                if (verbose > 1)
+                                        dprintk("CA PMT Command = CA PMT query\n");
+                        }
+                }
+        }
+        else {
+                hw_buffer->msg[11] = hw_buffer->msg[11] & 0xf0;         /*      Don't write to ASIC             */
+                hw_buffer->msg[12] = hw_buffer->msg[12] = 0x00;
+        }
+        if (verbose > 4)
+                dprintk("%s:**********>p_ca_message->length=[%d], buf_offset=[%d], hw_offset=[%d]\n",
+                                        __FUNCTION__, p_ca_message->length, buf_offset, hw_offset);
+
+        while ((buf_offset  < p_ca_message->length)  && !error_condition) {
+                /*      Bail out in case of an indefinite loop          */
+                if ((es_info_length > p_ca_message->length) || (buf_offset > p_ca_message->length)) {
+                        dprintk("%s:\"WARNING\" Length error, line=[%d], prog_info_length=[%d], buf_offset=[%d]\n",
+                                                        __FUNCTION__, __LINE__, program_info_length, buf_offset);
+
+                        dprintk("%s:\"WARNING\" Bailing out of possible loop\n", __FUNCTION__);
+                        error_condition = 1;
+                        break;
+                }
+
+                /*              Stream Header                           */
+
+                for (k = 0; k < 5; k++) {
+                        hw_buffer->msg[hw_offset + k] = p_ca_message->msg[buf_offset + k];
+                }
+
+                es_info_length = 0;
+                es_info_length = (es_info_length | (p_ca_message->msg[buf_offset + 3] & 0x0f)) << 8 | p_ca_message->msg[buf_offset + 4];
+
+                if (verbose > 4) {
+                        dprintk("\n%s:----->Stream header=[%02x %02x %02x %02x %02x]\n", __FUNCTION__,
+                                p_ca_message->msg[buf_offset + 0], p_ca_message->msg[buf_offset + 1],
+                                p_ca_message->msg[buf_offset + 2], p_ca_message->msg[buf_offset + 3],
+                                p_ca_message->msg[buf_offset + 4]);
+
+                        dprintk("%s:----->Stream type=[%02x], es length=[%d (0x%x)], Chars=[%02x] [%02x], buf_offset=[%d]\n", __FUNCTION__,
+                                p_ca_message->msg[buf_offset + 0], es_info_length, es_info_length,
+                                p_ca_message->msg[buf_offset + 3], p_ca_message->msg[buf_offset + 4], buf_offset);
+                }
+
+                hw_buffer->msg[hw_offset + 3] &= 0x0f;                  /*      req only 4 bits                 */
+
+                if (found_prog_ca_desc) {
+                        hw_buffer->msg[hw_offset + 3] = 0x00;
+                        hw_buffer->msg[hw_offset + 4] = 0x00;
+                }
+
+                hw_offset += 5, buf_offset += 5, hw_buffer_length += 5;
+
+                /*              Check for CA descriptor                 */
+                if (p_ca_message->msg[buf_offset + 1] == 0x09) {
+                        if (verbose > 4)
+                                dprintk("%s:Found CA descriptor @ Stream level\n", __FUNCTION__);
+                        found_stream_ca_desc = 1;
+                }
+
+                /*              ES descriptors                          */
+
+                if (es_info_length && !error_condition && !found_prog_ca_desc && found_stream_ca_desc) {
+//                      if (!ca_pmt_done) {
+                                hw_buffer->msg[hw_offset] = p_ca_message->msg[buf_offset];      /*      CA PMT cmd(es)  */
+                                if (verbose > 4)
+                                        printk("%s:----->CA PMT Command ID=[%02x]\n", __FUNCTION__, p_ca_message->msg[buf_offset]);
+//                              hw_offset++, buf_offset++, hw_buffer_length++, es_info_length--, ca_pmt_done = 1;
+                                hw_offset++, buf_offset++, hw_buffer_length++, es_info_length--;
+//                      }
+                        if (verbose > 4)
+                                dprintk("%s:----->ES descriptors=[", __FUNCTION__);
+
+                        while (es_info_length && !error_condition) {    /*      ES descriptors                  */
+                                if ((es_info_length > p_ca_message->length) || (buf_offset > p_ca_message->length)) {
+                                        if (verbose > 4) {
+                                                dprintk("%s:\"WARNING\" ES Length error, line=[%d], es_info_length=[%d], buf_offset=[%d]\n",
+                                                                                __FUNCTION__, __LINE__, es_info_length, buf_offset);
+
+                                                dprintk("%s:\"WARNING\" Bailing out of possible loop\n", __FUNCTION__);
+                                        }
+                                        error_condition = 1;
+                                        break;
+                                }
+
+                                hw_buffer->msg[hw_offset] = p_ca_message->msg[buf_offset];
+                                if (verbose > 3)
+                                        dprintk("%02x ", hw_buffer->msg[hw_offset]);
+                                hw_offset++, buf_offset++, hw_buffer_length++, es_info_length--;
+                        }
+                        found_stream_ca_desc = 0;                       /*      unset for new streams           */
+                        dprintk("]\n");
+                }
+        }
+
+        /*              MCU Magic words                                 */
+
+        hw_buffer_length += 7;
+        hw_buffer->msg[0] = hw_buffer_length;
+        hw_buffer->msg[1] = 64;
+        hw_buffer->msg[4] = 3;
+        hw_buffer->msg[5] = hw_buffer->msg[0] - 7;
+        hw_buffer->msg[6] = 0;
+
+
+        /*      Fix length      */
+        hw_buffer->length = hw_buffer->msg[0];
+
+        put_checksum(&hw_buffer->msg[0], hw_buffer->msg[0]);
+        /*      Do the actual write     */
+        if (verbose > 4) {
+                dprintk("%s:======================DEBUGGING================================\n", __FUNCTION__);
+                dprintk("%s: Actual Length=[%d]\n", __FUNCTION__, hw_buffer_length);
+        }
+        /*      Only for debugging!     */
+        if (verbose > 2)
+                debug_8820_buffer(hw_buffer);
+        if (verbose > 3)
+                dprintk("%s: Reply = [%d]\n", __FUNCTION__, reply);
+        write_to_8820(state, hw_buffer, reply);
+
+        return 0;
+}
+
+/*      Board supports CA PMT reply ?           */
+static int dst_check_ca_pmt(struct dst_state *state, struct ca_msg *p_ca_message, struct ca_msg *hw_buffer)
+{
+        int ca_pmt_reply_test = 0;
+
+        /*      Do test board                   */
+        /*      Not there yet but soon          */
+
+
+        /*      CA PMT Reply capable            */
+        if (ca_pmt_reply_test) {
+                if ((ca_set_pmt(state, p_ca_message, hw_buffer, 1, GET_REPLY)) < 0) {
+                        dprintk("%s: ca_set_pmt.. failed !\n", __FUNCTION__);
+                        return -1;
+                }
+
+        /*      Process CA PMT Reply            */
+        /*      will implement soon             */
+                dprintk("%s: Not there yet\n", __FUNCTION__);
+        }
+        /*      CA PMT Reply not capable        */
+        if (!ca_pmt_reply_test) {
+                if ((ca_set_pmt(state, p_ca_message, hw_buffer, 0, NO_REPLY)) < 0) {
+                        dprintk("%s: ca_set_pmt.. failed !\n", __FUNCTION__);
+                        return -1;
+                }
+                if (verbose > 3)
+                        dprintk("%s: ca_set_pmt.. success !\n", __FUNCTION__);
+        /*      put a dummy message             */
+
+        }
+        return 0;
+}
+
+static int ca_send_message(struct dst_state *state, struct ca_msg *p_ca_message, void *arg)
+{
+        int i = 0;
+        unsigned int ca_message_header_len;
+
+        u32 command = 0;
+        struct ca_msg *hw_buffer;
+
+        if ((hw_buffer = (struct ca_msg *) kmalloc(sizeof (struct ca_msg), GFP_KERNEL)) == NULL) {
+                printk("%s: Memory allocation failure\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        if (verbose > 3)
+                dprintk("%s\n", __FUNCTION__);
+
+        if (copy_from_user(p_ca_message, (void *)arg, sizeof (struct ca_msg)))
+                return -EFAULT;
+
+        if (p_ca_message->msg) {
+                ca_message_header_len = p_ca_message->length;   /*      Restore it back when you are done       */
+                /*      EN50221 tag     */
+                command = 0;
+
+                for (i = 0; i < 3; i++) {
+                        command = command | p_ca_message->msg[i];
+                        if (i < 2)
+                                command = command << 8;
+                }
+                if (verbose > 3)
+                        dprintk("%s:Command=[0x%x]\n", __FUNCTION__, command);
+
+                switch (command) {
+                        case CA_PMT:
+                                if (verbose > 3)
+                                        dprintk("Command = SEND_CA_PMT\n");
+                                if ((ca_set_pmt(state, p_ca_message, hw_buffer, 0, 0)) < 0) {
+                                        dprintk("%s: -->CA_PMT Failed !\n", __FUNCTION__);
+                                        return -1;
+                                }
+                                if (verbose > 3)
+                                        dprintk("%s: -->CA_PMT Success !\n", __FUNCTION__);
+//                              retval = dummy_set_pmt(state, p_ca_message, hw_buffer, 0, 0);
+
+                                break;
+
+                        case CA_PMT_REPLY:
+                                if (verbose > 3)
+                                        dprintk("Command = CA_PMT_REPLY\n");
+                                /*      Have to handle the 2 basic types of cards here  */
+                                if ((dst_check_ca_pmt(state, p_ca_message, hw_buffer)) < 0) {
+                                        dprintk("%s: -->CA_PMT_REPLY Failed !\n", __FUNCTION__);
+                                        return -1;
+                                }
+                                if (verbose > 3)
+                                        dprintk("%s: -->CA_PMT_REPLY Success !\n", __FUNCTION__);
+
+                                /*      Certain boards do behave different ?            */
+//                              retval = ca_set_pmt(state, p_ca_message, hw_buffer, 1, 1);
+
+                        case CA_APP_INFO_ENQUIRY:               // only for debugging
+                                if (verbose > 3)
+                                        dprintk("%s: Getting Cam Application information\n", __FUNCTION__);
+
+                                if ((ca_get_app_info(state)) < 0) {
+                                        dprintk("%s: -->CA_APP_INFO_ENQUIRY Failed !\n", __FUNCTION__);
+                                        return -1;
+                                }
+                                if (verbose > 3)
+                                        printk("%s: -->CA_APP_INFO_ENQUIRY Success !\n", __FUNCTION__);
+
+                                break;
+                }
+        }
+        return 0;
+}
+
+static int dst_ca_ioctl(struct inode *inode, struct file *file, unsigned int cmd, void *arg)
+{
+        struct dvb_device* dvbdev = (struct dvb_device*) file->private_data;
+        struct dst_state* state = (struct dst_state*) dvbdev->priv;
+        struct ca_slot_info *p_ca_slot_info;
+        struct ca_caps *p_ca_caps;
+        struct ca_msg *p_ca_message;
+
+        if ((p_ca_message = (struct ca_msg *) kmalloc(sizeof (struct ca_msg), GFP_KERNEL)) == NULL) {
+                printk("%s: Memory allocation failure\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+
+        if ((p_ca_slot_info = (struct ca_slot_info *) kmalloc(sizeof (struct ca_slot_info), GFP_KERNEL)) == NULL) {
+                printk("%s: Memory allocation failure\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+
+        if ((p_ca_caps = (struct ca_caps *) kmalloc(sizeof (struct ca_caps), GFP_KERNEL)) == NULL) {
+                printk("%s: Memory allocation failure\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+
+        /*      We have now only the standard ioctl's, the driver is upposed to handle internals.       */
+        switch (cmd) {
+                case CA_SEND_MSG:
+                        if (verbose > 1)
+                                dprintk("%s: Sending message\n", __FUNCTION__);
+                        if ((ca_send_message(state, p_ca_message, arg)) < 0) {
+                                dprintk("%s: -->CA_SEND_MSG Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+
+                        break;
+
+                case CA_GET_MSG:
+                        if (verbose > 1)
+                                dprintk("%s: Getting message\n", __FUNCTION__);
+                        if ((ca_get_message(state, p_ca_message, arg)) < 0) {
+                                dprintk("%s: -->CA_GET_MSG Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+                        if (verbose > 1)
+                                dprintk("%s: -->CA_GET_MSG Success !\n", __FUNCTION__);
+
+                        break;
+
+                case CA_RESET:
+                        if (verbose > 1)
+                                dprintk("%s: Resetting DST\n", __FUNCTION__);
+                        dst_error_bailout(state);
+                        msleep(4000);
+
+                        break;
+
+                case CA_GET_SLOT_INFO:
+                        if (verbose > 1)
+                                dprintk("%s: Getting Slot info\n", __FUNCTION__);
+                        if ((ca_get_slot_info(state, p_ca_slot_info, arg)) < 0) {
+                                dprintk("%s: -->CA_GET_SLOT_INFO Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+                        if (verbose > 1)
+                                dprintk("%s: -->CA_GET_SLOT_INFO Success !\n", __FUNCTION__);
+
+                        break;
+
+                case CA_GET_CAP:
+                        if (verbose > 1)
+                                dprintk("%s: Getting Slot capabilities\n", __FUNCTION__);
+                        if ((ca_get_slot_caps(state, p_ca_caps, arg)) < 0) {
+                                dprintk("%s: -->CA_GET_CAP Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+                        if (verbose > 1)
+                                dprintk("%s: -->CA_GET_CAP Success !\n", __FUNCTION__);
+
+                        break;
+
+                case CA_GET_DESCR_INFO:
+                        if (verbose > 1)
+                                dprintk("%s: Getting descrambler description\n", __FUNCTION__);
+                        if ((ca_get_slot_descr(state, p_ca_message, arg)) < 0) {
+                                dprintk("%s: -->CA_GET_DESCR_INFO Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+                        if (verbose > 1)
+                                dprintk("%s: -->CA_GET_DESCR_INFO Success !\n", __FUNCTION__);
+
+                        break;
+
+                case CA_SET_DESCR:
+                        if (verbose > 1)
+                                dprintk("%s: Setting descrambler\n", __FUNCTION__);
+                        if ((ca_set_slot_descr()) < 0) {
+                                dprintk("%s: -->CA_SET_DESCR Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+                        if (verbose > 1)
+                                dprintk("%s: -->CA_SET_DESCR Success !\n", __FUNCTION__);
+
+                        break;
+
+                case CA_SET_PID:
+                        if (verbose > 1)
+                                dprintk("%s: Setting PID\n", __FUNCTION__);
+                        if ((ca_set_pid()) < 0) {
+                                dprintk("%s: -->CA_SET_PID Failed !\n", __FUNCTION__);
+                                return -1;
+                        }
+                        if (verbose > 1)
+                                dprintk("%s: -->CA_SET_PID Success !\n", __FUNCTION__);
+
+                default:
+                        return -EOPNOTSUPP;
+                };
+
+        return 0;
+}
+
+static int dst_ca_open(struct inode *inode, struct file *file)
+{
+        if (verbose > 4)
+                dprintk("%s:Device opened [%p]\n", __FUNCTION__, file);
+        try_module_get(THIS_MODULE);
+
+        return 0;
+}
+
+static int dst_ca_release(struct inode *inode, struct file *file)
+{
+        if (verbose > 4)
+                dprintk("%s:Device closed.\n", __FUNCTION__);
+        module_put(THIS_MODULE);
+
+        return 0;
+}
+
+static int dst_ca_read(struct file *file, char __user * buffer, size_t length, loff_t * offset)
+{
+        int bytes_read = 0;
+
+        if (verbose > 4)
+                dprintk("%s:Device read.\n", __FUNCTION__);
+
+        return bytes_read;
+}
+
+static int dst_ca_write(struct file *file, const char __user * buffer, size_t length, loff_t * offset)
+{
+        if (verbose > 4)
+                dprintk("%s:Device write.\n", __FUNCTION__);
+
+        return 0;
+}
+
+static struct file_operations dst_ca_fops = {
+        .owner = THIS_MODULE,
+        .ioctl = (void *)dst_ca_ioctl,
+        .open = dst_ca_open,
+        .release = dst_ca_release,
+        .read = dst_ca_read,
+        .write = dst_ca_write
+};
+
+static struct dvb_device dvbdev_ca = {
+        .priv = NULL,
+        .users = 1,
+        .readers = 1,
+        .writers = 1,
+        .fops = &dst_ca_fops
+};
+
+int dst_ca_attach(struct dst_state *dst, struct dvb_adapter *dvb_adapter)
+{
+        struct dvb_device *dvbdev;
+        if (verbose > 4)
+                dprintk("%s:registering DST-CA device\n", __FUNCTION__);
+        dvb_register_device(dvb_adapter, &dvbdev, &dvbdev_ca, dst, DVB_DEVICE_CA);
+        return 0;
+}
+
+EXPORT_SYMBOL(dst_ca_attach);
+
+MODULE_DESCRIPTION("DST DVB-S/T/C Combo CA driver");
+MODULE_AUTHOR("Manu Abraham");
+MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/bt8xx/dst_ca.h b/drivers/media/dvb/bt8xx/dst_ca.h
new file mode 100644
index 000000000000..59cd0ddd6d8e
--- /dev/null
+++ b/drivers/media/dvb/bt8xx/dst_ca.h
@@ -0,0 +1,58 @@
+/*
+        CA-driver for TwinHan DST Frontend/Card
+
+        Copyright (C) 2004, 2005 Manu Abraham (manu@kromtek.com)
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the Free Software
+        Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef _DST_CA_H_
+#define _DST_CA_H_
+
+#define RETRIES                 5
+
+
+#define CA_APP_INFO_ENQUIRY     0x9f8020
+#define CA_APP_INFO             0x9f8021
+#define CA_ENTER_MENU           0x9f8022
+#define CA_INFO_ENQUIRY         0x9f8030
+#define CA_INFO                 0x9f8031
+#define CA_PMT                  0x9f8032
+#define CA_PMT_REPLY            0x9f8033
+
+#define CA_CLOSE_MMI            0x9f8800
+#define CA_DISPLAY_CONTROL      0x9f8801
+#define CA_DISPLAY_REPLY        0x9f8802
+#define CA_TEXT_LAST            0x9f8803
+#define CA_TEXT_MORE            0x9f8804
+#define CA_KEYPAD_CONTROL       0x9f8805
+#define CA_KEYPRESS             0x9f8806
+
+#define CA_ENQUIRY              0x9f8807
+#define CA_ANSWER               0x9f8808
+#define CA_MENU_LAST            0x9f8809
+#define CA_MENU_MORE            0x9f880a
+#define CA_MENU_ANSWER          0x9f880b
+#define CA_LIST_LAST            0x9f880c
+#define CA_LIST_MORE            0x9f880d
+
+
+struct dst_ca_private {
+        struct dst_state *dst;
+        struct dvb_device *dvbdev;
+};
+
+
+#endif
diff --git a/drivers/media/dvb/bt8xx/dst_common.h b/drivers/media/dvb/bt8xx/dst_common.h
new file mode 100644
index 000000000000..0b3da29245fb
--- /dev/null
+++ b/drivers/media/dvb/bt8xx/dst_common.h
@@ -0,0 +1,153 @@
+/*
+        Frontend-driver for TwinHan DST Frontend
+
+        Copyright (C) 2003 Jamie Honan
+        Copyright (C) 2004, 2005 Manu Abraham (manu@kromtek.com)
+
+        This program is free software; you can redistribute it and/or modify
+        it under the terms of the GNU General Public License as published by
+        the Free Software Foundation; either version 2 of the License, or
+        (at your option) any later version.
+
+        This program is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+        GNU General Public License for more details.
+
+        You should have received a copy of the GNU General Public License
+        along with this program; if not, write to the Free Software
+        Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef DST_COMMON_H
+#define DST_COMMON_H
+
+#include <linux/dvb/frontend.h>
+#include <linux/device.h>
+#include "bt878.h"
+
+#include "dst_ca.h"
+
+
+#define NO_DELAY                0
+#define LONG_DELAY              1
+#define DEVICE_INIT             2
+
+#define DELAY                   1
+
+#define DST_TYPE_IS_SAT         0
+#define DST_TYPE_IS_TERR        1
+#define DST_TYPE_IS_CABLE       2
+#define DST_TYPE_IS_ATSC        3
+
+#define DST_TYPE_HAS_NEWTUNE    1
+#define DST_TYPE_HAS_TS204      2
+#define DST_TYPE_HAS_SYMDIV     4
+#define DST_TYPE_HAS_FW_1       8
+#define DST_TYPE_HAS_FW_2       16
+#define DST_TYPE_HAS_FW_3       32
+#define DST_TYPE_HAS_FW_BUILD   64
+
+/*      Card capability list    */
+
+#define DST_TYPE_HAS_MAC        1
+#define DST_TYPE_HAS_DISEQC3    2
+#define DST_TYPE_HAS_DISEQC4    4
+#define DST_TYPE_HAS_DISEQC5    8
+#define DST_TYPE_HAS_MOTO       16
+#define DST_TYPE_HAS_CA         32
+#define DST_TYPE_HAS_ANALOG     64      /*      Analog inputs   */
+#define DST_TYPE_HAS_SESSION    128
+
+
+#define RDC_8820_PIO_0_DISABLE  0
+#define RDC_8820_PIO_0_ENABLE   1
+#define RDC_8820_INT            2
+#define RDC_8820_RESET          4
+
+/*      DST Communication       */
+#define GET_REPLY               1
+#define NO_REPLY                0
+
+#define GET_ACK                 1
+#define FIXED_COMM              8
+
+#define ACK                     0xff
+
+struct dst_state {
+
+        struct i2c_adapter* i2c;
+
+        struct bt878* bt;
+
+        struct dvb_frontend_ops ops;
+
+        /* configuration settings */
+        const struct dst_config* config;
+
+        struct dvb_frontend frontend;
+
+        /* private ASIC data */
+        u8 tx_tuna[10];
+        u8 rx_tuna[10];
+        u8 rxbuffer[10];
+        u8 diseq_flags;
+        u8 dst_type;
+        u32 type_flags;
+        u32 frequency;          /* intermediate frequency in kHz for QPSK */
+        fe_spectral_inversion_t inversion;
+        u32 symbol_rate;        /* symbol rate in Symbols per second */
+        fe_code_rate_t fec;
+        fe_sec_voltage_t voltage;
+        fe_sec_tone_mode_t tone;
+        u32 decode_freq;
+        u8 decode_lock;
+        u16 decode_strength;
+        u16 decode_snr;
+        unsigned long cur_jiff;
+        u8 k22;
+        fe_bandwidth_t bandwidth;
+        u32 dst_hw_cap;
+        u8 dst_fw_version;
+        fe_sec_mini_cmd_t minicmd;
+        u8 messages[256];
+};
+
+struct dst_types {
+        char *device_id;
+        int offset;
+        u8 dst_type;
+        u32 type_flags;
+        u32 dst_feature;
+};
+
+
+
+struct dst_config
+{
+        /* the ASIC i2c address */
+        u8 demod_address;
+};
+
+
+int rdc_reset_state(struct dst_state *state);
+int rdc_8820_reset(struct dst_state *state);
+
+int dst_wait_dst_ready(struct dst_state *state, u8 delay_mode);
+int dst_pio_enable(struct dst_state *state);
+int dst_pio_disable(struct dst_state *state);
+int dst_error_recovery(struct dst_state* state);
+int dst_error_bailout(struct dst_state *state);
+int dst_comm_init(struct dst_state* state);
+
+int write_dst(struct dst_state *state, u8 * data, u8 len);
+int read_dst(struct dst_state *state, u8 * ret, u8 len);
+u8 dst_check_sum(u8 * buf, u32 len);
+struct dst_state* dst_attach(struct dst_state* state, struct dvb_adapter *dvb_adapter);
+int dst_ca_attach(struct dst_state *state, struct dvb_adapter *dvb_adapter);
+int dst_gpio_outb(struct dst_state* state, u32 mask, u32 enbb, u32 outhigh, int delay);
+
+int dst_command(struct dst_state* state, u8 * data, u8 len);
+
+
+#endif // DST_COMMON_H
diff --git a/drivers/media/dvb/bt8xx/dst_priv.h b/drivers/media/dvb/bt8xx/dst_priv.h
index 80488aa628b4..3974a4c6ebe7 100644
--- a/drivers/media/dvb/bt8xx/dst_priv.h
+++ b/drivers/media/dvb/bt8xx/dst_priv.h
@@ -33,4 +33,3 @@ union dst_gpio_packet {
 struct bt878;
 
 int bt878_device_control(struct bt878 *bt, unsigned int cmd, union dst_gpio_packet *mp);
-
diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.c b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
index b735397f59aa..6f857c6091f3 100644
--- a/drivers/media/dvb/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
@@ -142,7 +142,7 @@ static int thomson_dtt7579_demod_init(struct dvb_frontend* fe)
         mt352_write(fe, mt352_adc_ctl_1_cfg, sizeof(mt352_adc_ctl_1_cfg));
 
         mt352_write(fe, mt352_agc_cfg, sizeof(mt352_agc_cfg));
-        mt352_write(fe, mt352_gpp_ctl_cfg, sizeof(mt352_gpp_ctl_cfg));
+        mt352_write(fe, mt352_gpp_ctl_cfg, sizeof(mt352_gpp_ctl_cfg));
         mt352_write(fe, mt352_capt_range_cfg, sizeof(mt352_capt_range_cfg));
 
         return 0;
@@ -161,7 +161,7 @@ static int thomson_dtt7579_pll_set(struct dvb_frontend* fe, struct dvb_frontend_
         else if (params->frequency < 771000000) cp = 0xbc;
         else cp = 0xf4;
 
-        if (params->frequency == 0) bs = 0x03;
+        if (params->frequency == 0) bs = 0x03;
         else if (params->frequency < 443250000) bs = 0x02;
         else bs = 0x08;
 
@@ -190,44 +190,44 @@ static int cx24108_pll_set(struct dvb_frontend* fe, struct dvb_frontend_paramete
 
 
    u32 osci[]={950000,1019000,1075000,1178000,1296000,1432000,
-               1576000,1718000,1856000,2036000,2150000};
+               1576000,1718000,1856000,2036000,2150000};
    u32 bandsel[]={0,0x00020000,0x00040000,0x00100800,0x00101000,
-               0x00102000,0x00104000,0x00108000,0x00110000,
-               0x00120000,0x00140000};
+               0x00102000,0x00104000,0x00108000,0x00110000,
+               0x00120000,0x00140000};
 
 #define XTAL 1011100 /* Hz, really 1.0111 MHz and a /10 prescaler */
-        printk("cx24108 debug: entering SetTunerFreq, freq=%d\n",freq);
-
-        /* This is really the bit driving the tuner chip cx24108 */
-
-        if(freq<950000) freq=950000; /* kHz */
-        if(freq>2150000) freq=2150000; /* satellite IF is 950..2150MHz */
-
-        /* decide which VCO to use for the input frequency */
-        for(i=1;(i<sizeof(osci)/sizeof(osci[0]))&&(osci[i]<freq);i++);
-        printk("cx24108 debug: select vco #%d (f=%d)\n",i,freq);
-        band=bandsel[i];
-        /* the gain values must be set by SetSymbolrate */
-        /* compute the pll divider needed, from Conexant data sheet,
-           resolved for (n*32+a), remember f(vco) is f(receive) *2 or *4,
-           depending on the divider bit. It is set to /4 on the 2 lowest
-           bands  */
-        n=((i<=2?2:1)*freq*10L)/(XTAL/100);
-        a=n%32; n/=32; if(a==0) n--;
-        pump=(freq<(osci[i-1]+osci[i])/2);
-        pll=0xf8000000|
-            ((pump?1:2)<<(14+11))|
-            ((n&0x1ff)<<(5+11))|
-            ((a&0x1f)<<11);
-        /* everything is shifted left 11 bits to left-align the bits in the
-           32bit word. Output to the tuner goes MSB-aligned, after all */
-        printk("cx24108 debug: pump=%d, n=%d, a=%d\n",pump,n,a);
-        cx24110_pll_write(fe,band);
-        /* set vga and vca to their widest-band settings, as a precaution.
-           SetSymbolrate might not be called to set this up */
-        cx24110_pll_write(fe,0x500c0000);
-        cx24110_pll_write(fe,0x83f1f800);
-        cx24110_pll_write(fe,pll);
+        printk("cx24108 debug: entering SetTunerFreq, freq=%d\n",freq);
+
+        /* This is really the bit driving the tuner chip cx24108 */
+
+        if(freq<950000) freq=950000; /* kHz */
+        if(freq>2150000) freq=2150000; /* satellite IF is 950..2150MHz */
+
+        /* decide which VCO to use for the input frequency */
+        for(i=1;(i<sizeof(osci)/sizeof(osci[0]))&&(osci[i]<freq);i++);
+        printk("cx24108 debug: select vco #%d (f=%d)\n",i,freq);
+        band=bandsel[i];
+        /* the gain values must be set by SetSymbolrate */
+        /* compute the pll divider needed, from Conexant data sheet,
+           resolved for (n*32+a), remember f(vco) is f(receive) *2 or *4,
+           depending on the divider bit. It is set to /4 on the 2 lowest
+           bands  */
+        n=((i<=2?2:1)*freq*10L)/(XTAL/100);
+        a=n%32; n/=32; if(a==0) n--;
+        pump=(freq<(osci[i-1]+osci[i])/2);
+        pll=0xf8000000|
+            ((pump?1:2)<<(14+11))|
+            ((n&0x1ff)<<(5+11))|
+            ((a&0x1f)<<11);
+        /* everything is shifted left 11 bits to left-align the bits in the
+           32bit word. Output to the tuner goes MSB-aligned, after all */
+        printk("cx24108 debug: pump=%d, n=%d, a=%d\n",pump,n,a);
+        cx24110_pll_write(fe,band);
+        /* set vga and vca to their widest-band settings, as a precaution.
+           SetSymbolrate might not be called to set this up */
+        cx24110_pll_write(fe,0x500c0000);
+        cx24110_pll_write(fe,0x83f1f800);
+        cx24110_pll_write(fe,pll);
 /*        writereg(client,0x56,0x7f);*/
 
         return 0;
@@ -299,7 +299,7 @@ static int advbt771_samsung_tdtc9251dh0_demod_init(struct dvb_frontend* fe)
         static u8 mt352_reset [] = { 0x50, 0x80 };
         static u8 mt352_adc_ctl_1_cfg [] = { 0x8E, 0x40 };
         static u8 mt352_agc_cfg [] = { 0x67, 0x10, 0x23, 0x00, 0xFF, 0xFF,
-                                       0x00, 0xFF, 0x00, 0x40, 0x40 };
+                                       0x00, 0xFF, 0x00, 0x40, 0x40 };
         static u8 mt352_av771_extra[] = { 0xB5, 0x7A };
         static u8 mt352_capt_range_cfg[] = { 0x75, 0x32 };
 
@@ -463,6 +463,9 @@ static struct nxt6000_config vp3021_alps_tded4_config = {
 
 static void frontend_init(struct dvb_bt8xx_card *card, u32 type)
 {
+        int ret;
+        struct dst_state* state = NULL;
+
         switch(type) {
 #ifdef BTTV_DVICO_DVBT_LITE
         case BTTV_DVICO_DVBT_LITE:
@@ -503,7 +506,25 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 type)
                 break;
 
         case BTTV_TWINHAN_DST:
-                card->fe = dst_attach(&dst_config, card->i2c_adapter, card->bt);
+                /*      DST is not a frontend driver !!!                */
+                state = (struct dst_state *) kmalloc(sizeof (struct dst_state), GFP_KERNEL);
+                /*      Setup the Card                                  */
+                state->config = &dst_config;
+                state->i2c = card->i2c_adapter;
+                state->bt = card->bt;
+
+                /*      DST is not a frontend, attaching the ASIC       */
+                if ((dst_attach(state, &card->dvb_adapter)) == NULL) {
+                        printk("%s: Could not find a Twinhan DST.\n", __FUNCTION__);
+                        break;
+                }
+                card->fe = &state->frontend;
+
+                /*      Attach other DST peripherals if any             */
+                /*      Conditional Access device                       */
+                if (state->dst_hw_cap & DST_TYPE_HAS_CA) {
+                        ret = dst_ca_attach(state, &card->dvb_adapter);
+                }
                 if (card->fe != NULL) {
                         break;
                 }
@@ -531,7 +552,7 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 type)
                        card->bt->dev->subsystem_vendor,
                        card->bt->dev->subsystem_device);
         } else {
-                if (dvb_register_frontend(card->dvb_adapter, card->fe)) {
+                if (dvb_register_frontend(&card->dvb_adapter, card->fe)) {
                         printk("dvb-bt8xx: Frontend registration failed!\n");
                         if (card->fe->ops->release)
                                 card->fe->ops->release(card->fe);
@@ -550,7 +571,7 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
                 return result;
 
         }
-        card->dvb_adapter->priv = card;
+        card->dvb_adapter.priv = card;
 
         card->bt->adapter = card->i2c_adapter;
 
@@ -568,7 +589,7 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
         if ((result = dvb_dmx_init(&card->demux)) < 0) {
                 printk("dvb_bt8xx: dvb_dmx_init failed (errno = %d)\n", result);
 
-                dvb_unregister_adapter(card->dvb_adapter);
+                dvb_unregister_adapter(&card->dvb_adapter);
                 return result;
         }
 
@@ -576,11 +597,11 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
         card->dmxdev.demux = &card->demux.dmx;
         card->dmxdev.capabilities = 0;
 
-        if ((result = dvb_dmxdev_init(&card->dmxdev, card->dvb_adapter)) < 0) {
+        if ((result = dvb_dmxdev_init(&card->dmxdev, &card->dvb_adapter)) < 0) {
                 printk("dvb_bt8xx: dvb_dmxdev_init failed (errno = %d)\n", result);
 
                 dvb_dmx_release(&card->demux);
-                dvb_unregister_adapter(card->dvb_adapter);
+                dvb_unregister_adapter(&card->dvb_adapter);
                 return result;
         }
 
@@ -591,7 +612,7 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
 
                 dvb_dmxdev_release(&card->dmxdev);
                 dvb_dmx_release(&card->demux);
-                dvb_unregister_adapter(card->dvb_adapter);
+                dvb_unregister_adapter(&card->dvb_adapter);
                 return result;
         }
 
@@ -603,7 +624,7 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
                 card->demux.dmx.remove_frontend(&card->demux.dmx, &card->fe_hw);
                 dvb_dmxdev_release(&card->dmxdev);
                 dvb_dmx_release(&card->demux);
-                dvb_unregister_adapter(card->dvb_adapter);
+                dvb_unregister_adapter(&card->dvb_adapter);
                 return result;
         }
 
@@ -614,11 +635,11 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
                 card->demux.dmx.remove_frontend(&card->demux.dmx, &card->fe_hw);
                 dvb_dmxdev_release(&card->dmxdev);
                 dvb_dmx_release(&card->demux);
-                dvb_unregister_adapter(card->dvb_adapter);
+                dvb_unregister_adapter(&card->dvb_adapter);
                 return result;
         }
 
-        dvb_net_init(card->dvb_adapter, &card->dvbnet, &card->demux.dmx);
+        dvb_net_init(&card->dvb_adapter, &card->dvbnet, &card->demux.dmx);
 
         tasklet_init(&card->bt->tasklet, dvb_bt8xx_task, (unsigned long) card);
 
@@ -648,7 +669,7 @@ static int dvb_bt8xx_probe(struct device *dev)
         case BTTV_PINNACLESAT:
                 card->gpio_mode = 0x0400c060;
                 /* should be: BT878_A_GAIN=0,BT878_A_PWRDN,BT878_DA_DPM,BT878_DA_SBR,
-                              BT878_DA_IOM=1,BT878_DA_APP to enable serial highspeed mode. */
+                              BT878_DA_IOM=1,BT878_DA_APP to enable serial highspeed mode. */
                 card->op_sync_orin = 0;
                 card->irq_err_ignore = 0;
                 break;
@@ -759,7 +780,7 @@ static int dvb_bt8xx_remove(struct device *dev)
         dvb_dmxdev_release(&card->dmxdev);
         dvb_dmx_release(&card->demux);
         if (card->fe) dvb_unregister_frontend(card->fe);
-        dvb_unregister_adapter(card->dvb_adapter);
+        dvb_unregister_adapter(&card->dvb_adapter);
 
         kfree(card);
 
diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.h b/drivers/media/dvb/bt8xx/dvb-bt8xx.h
index 80ef189f930f..2923b3b0dd3c 100644
--- a/drivers/media/dvb/bt8xx/dvb-bt8xx.h
+++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.h
@@ -31,7 +31,7 @@
 #include "bttv.h"
 #include "mt352.h"
 #include "sp887x.h"
-#include "dst.h"
+#include "dst_common.h"
 #include "nxt6000.h"
 #include "cx24110.h"
 #include "or51211.h"
@@ -40,7 +40,7 @@ struct dvb_bt8xx_card {
         struct semaphore lock;
         int nfeeds;
         char card_name[32];
-        struct dvb_adapter *dvb_adapter;
+        struct dvb_adapter dvb_adapter;
         struct bt878 *bt;
         unsigned int bttv_nr;
         struct dvb_demux demux;
diff --git a/drivers/media/dvb/cinergyT2/cinergyT2.c b/drivers/media/dvb/cinergyT2/cinergyT2.c
index 28d4d926de3e..96c57fde95a0 100644
--- a/drivers/media/dvb/cinergyT2/cinergyT2.c
+++ b/drivers/media/dvb/cinergyT2/cinergyT2.c
@@ -119,7 +119,7 @@ struct cinergyt2 {
         struct dvb_demux demux;
         struct usb_device *udev;
         struct semaphore sem;
-        struct dvb_adapter *adapter;
+        struct dvb_adapter adapter;
         struct dvb_device *fedev;
         struct dmxdev dmxdev;
         struct dvb_net dvbnet;
@@ -813,15 +813,15 @@ static int cinergyt2_probe (struct usb_interface *intf,
         cinergyt2->dmxdev.demux = &cinergyt2->demux.dmx;
         cinergyt2->dmxdev.capabilities = 0;
 
-        if ((err = dvb_dmxdev_init(&cinergyt2->dmxdev, cinergyt2->adapter)) < 0) {
+        if ((err = dvb_dmxdev_init(&cinergyt2->dmxdev, &cinergyt2->adapter)) < 0) {
                 dprintk(1, "dvb_dmxdev_init() failed (err = %d)\n", err);
                 goto bailout;
         }
 
-        if (dvb_net_init(cinergyt2->adapter, &cinergyt2->dvbnet, &cinergyt2->demux.dmx))
+        if (dvb_net_init(&cinergyt2->adapter, &cinergyt2->dvbnet, &cinergyt2->demux.dmx))
                 dprintk(1, "dvb_net_init() failed!\n");
 
-        dvb_register_device(cinergyt2->adapter, &cinergyt2->fedev,
+        dvb_register_device(&cinergyt2->adapter, &cinergyt2->fedev,
                             &cinergyt2_fe_template, cinergyt2,
                             DVB_DEVICE_FRONTEND);
 
@@ -848,7 +848,7 @@ static int cinergyt2_probe (struct usb_interface *intf,
 bailout:
         dvb_dmxdev_release(&cinergyt2->dmxdev);
         dvb_dmx_release(&cinergyt2->demux);
-        dvb_unregister_adapter (cinergyt2->adapter);
+        dvb_unregister_adapter (&cinergyt2->adapter);
         cinergyt2_free_stream_urbs (cinergyt2);
         kfree(cinergyt2);
         return -ENOMEM;
@@ -872,7 +872,7 @@ static void cinergyt2_disconnect (struct usb_interface *intf)
         dvb_dmxdev_release(&cinergyt2->dmxdev);
         dvb_dmx_release(&cinergyt2->demux);
         dvb_unregister_device(cinergyt2->fedev);
-        dvb_unregister_adapter(cinergyt2->adapter);
+        dvb_unregister_adapter(&cinergyt2->adapter);
 
         cinergyt2_free_stream_urbs(cinergyt2);
         up(&cinergyt2->sem);
diff --git a/drivers/media/dvb/dibusb/dvb-dibusb-dvb.c b/drivers/media/dvb/dibusb/dvb-dibusb-dvb.c
index 04e54ec093f0..400b439e804e 100644
--- a/drivers/media/dvb/dibusb/dvb-dibusb-dvb.c
+++ b/drivers/media/dvb/dibusb/dvb-dibusb-dvb.c
@@ -131,7 +131,7 @@ int dibusb_dvb_init(struct usb_dibusb *dib)
                 deb_info("dvb_register_adapter failed: error %d", ret);
                 goto err;
         }
-        dib->adapter->priv = dib;
+        dib->adapter.priv = dib;
         
 /* i2c is done in dibusb_i2c_init */
         
@@ -151,18 +151,18 @@ int dibusb_dvb_init(struct usb_dibusb *dib)
         dib->dmxdev.filternum = dib->demux.filternum;
         dib->dmxdev.demux = &dib->demux.dmx;
         dib->dmxdev.capabilities = 0;
-        if ((ret = dvb_dmxdev_init(&dib->dmxdev, dib->adapter)) < 0) {
+        if ((ret = dvb_dmxdev_init(&dib->dmxdev, &dib->adapter)) < 0) {
                 err("dvb_dmxdev_init failed: error %d",ret);
                 goto err_dmx_dev;
         }
 
-        dvb_net_init(dib->adapter, &dib->dvb_net, &dib->demux.dmx);
+        dvb_net_init(&dib->adapter, &dib->dvb_net, &dib->demux.dmx);
 
         goto success;
 err_dmx_dev:
         dvb_dmx_release(&dib->demux);
 err_dmx:
-        dvb_unregister_adapter(dib->adapter);
+        dvb_unregister_adapter(&dib->adapter);
 err:
         return ret;
 success:
@@ -179,7 +179,7 @@ int dibusb_dvb_exit(struct usb_dibusb *dib)
                 dib->demux.dmx.close(&dib->demux.dmx);
                 dvb_dmxdev_release(&dib->dmxdev);
                 dvb_dmx_release(&dib->demux);
-                dvb_unregister_adapter(dib->adapter);
+                dvb_unregister_adapter(&dib->adapter);
         }
         return 0;
 }
diff --git a/drivers/media/dvb/dibusb/dvb-dibusb-fe-i2c.c b/drivers/media/dvb/dibusb/dvb-dibusb-fe-i2c.c
index 2ed89488c7c4..5a71b88797d9 100644
--- a/drivers/media/dvb/dibusb/dvb-dibusb-fe-i2c.c
+++ b/drivers/media/dvb/dibusb/dvb-dibusb-fe-i2c.c
@@ -183,7 +183,7 @@ int dibusb_fe_init(struct usb_dibusb* dib)
                        dib->dibdev->name);
                 return -ENODEV;
         } else {
-                if (dvb_register_frontend(dib->adapter, dib->fe)) {
+                if (dvb_register_frontend(&dib->adapter, dib->fe)) {
                         err("Frontend registration failed.");
                         if (dib->fe->ops->release)
                                 dib->fe->ops->release(dib->fe);
@@ -206,7 +206,7 @@ int dibusb_i2c_init(struct usb_dibusb *dib)
 {
         int ret = 0;
 
-        dib->adapter->priv = dib;
+        dib->adapter.priv = dib;
 
         strncpy(dib->i2c_adap.name,dib->dibdev->name,I2C_NAME_SIZE);
 #ifdef I2C_ADAP_CLASS_TV_DIGITAL
diff --git a/drivers/media/dvb/dibusb/dvb-dibusb.h b/drivers/media/dvb/dibusb/dvb-dibusb.h
index 52cd35dd9d83..c965b64fb1ab 100644
--- a/drivers/media/dvb/dibusb/dvb-dibusb.h
+++ b/drivers/media/dvb/dibusb/dvb-dibusb.h
@@ -181,7 +181,7 @@ struct usb_dibusb {
         struct semaphore i2c_sem;
 
         /* dvb */
-        struct dvb_adapter *adapter;
+        struct dvb_adapter adapter;
         struct dmxdev dmxdev;
         struct dvb_demux demux;
         struct dvb_net dvb_net;
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 1863f1dfb00c..c225de7ffd82 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -175,8 +175,8 @@ static inline void dvb_dmxdev_dvr_state_set(struct dmxdev_dvr *dmxdevdvr, int st
 
 static int dvb_dvr_open(struct inode *inode, struct file *file)
 {
-        struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev=(struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
         struct dmx_frontend *front;
 
         dprintk ("function : %s\n", __FUNCTION__);
@@ -224,8 +224,8 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
 
 static int dvb_dvr_release(struct inode *inode, struct file *file)
 {
-        struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev=(struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
 
         if (down_interruptible (&dmxdev->mutex))
                 return -ERESTARTSYS;
@@ -252,8 +252,8 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
 static ssize_t dvb_dvr_write(struct file *file, const char __user *buf,
                 size_t count, loff_t *ppos)
 {
-        struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev=(struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
         int ret;
 
         if (!dmxdev->demux->write)
@@ -270,8 +270,8 @@ static ssize_t dvb_dvr_write(struct file *file, const char __user *buf,
 static ssize_t dvb_dvr_read(struct file *file, char __user *buf, size_t count,
                 loff_t *ppos)
 {
-        struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev=(struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
         int ret;
 
         //down(&dmxdev->mutex);
@@ -345,7 +345,7 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
                             const u8 *buffer2, size_t buffer2_len,
                             struct dmx_section_filter *filter, enum dmx_success success)
 {
-        struct dmxdev_filter *dmxdevfilter=(struct dmxdev_filter *) filter->priv;
+        struct dmxdev_filter *dmxdevfilter = filter->priv;
         int ret;
 
         if (dmxdevfilter->buffer.error) {
@@ -381,7 +381,7 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
                        const u8 *buffer2, size_t buffer2_len,
                        struct dmx_ts_feed *feed, enum dmx_success success)
 {
-        struct dmxdev_filter *dmxdevfilter=(struct dmxdev_filter *) feed->priv;
+        struct dmxdev_filter *dmxdevfilter = feed->priv;
         struct dmxdev_buffer *buffer;
         int ret;
 
@@ -684,8 +684,8 @@ static int dvb_dmxdev_filter_start(struct dmxdev_filter *filter)
 
 static int dvb_demux_open(struct inode *inode, struct file *file)
 {
-        struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev=(struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
         int i;
         struct dmxdev_filter *dmxdevfilter;
 
@@ -1013,8 +1013,8 @@ static struct dvb_device dvbdev_demux = {
 static int dvb_dvr_do_ioctl(struct inode *inode, struct file *file,
                      unsigned int cmd, void *parg)
 {
-        struct dvb_device *dvbdev=(struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev=(struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
 
         int ret=0;
 
@@ -1044,8 +1044,8 @@ static int dvb_dvr_ioctl(struct inode *inode, struct file *file,
 
 static unsigned int dvb_dvr_poll (struct file *file, poll_table *wait)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dmxdev *dmxdev = (struct dmxdev *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dmxdev *dmxdev = dvbdev->priv;
         unsigned int mask = 0;
 
         dprintk ("function : %s\n", __FUNCTION__);
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
index c1ea89f2880c..0eb9aa711fb0 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
@@ -829,7 +829,7 @@ EXPORT_SYMBOL(dvb_ca_en50221_camready_irq);
  */
 void dvb_ca_en50221_camchange_irq(struct dvb_ca_en50221 *pubca, int slot, int change_type)
 {
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) pubca->private;
+        struct dvb_ca_private *ca = pubca->private;
 
         dprintk("CAMCHANGE IRQ slot:%i change_type:%i\n", slot, change_type);
 
@@ -857,7 +857,7 @@ EXPORT_SYMBOL(dvb_ca_en50221_frda_irq);
  */
 void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot)
 {
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) pubca->private;
+        struct dvb_ca_private *ca = pubca->private;
 
         dprintk("CAMREADY IRQ slot:%i\n", slot);
 
@@ -876,7 +876,7 @@ void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot)
  */
 void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot)
 {
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) pubca->private;
+        struct dvb_ca_private *ca = pubca->private;
         int flags;
 
         dprintk("FR/DA IRQ slot:%i\n", slot);
@@ -993,7 +993,7 @@ static void dvb_ca_en50221_thread_update_delay(struct dvb_ca_private *ca)
  */
 static int dvb_ca_en50221_thread(void *data)
 {
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) data;
+        struct dvb_ca_private *ca = data;
         char name[15];
         int slot;
         int flags;
@@ -1202,8 +1202,8 @@ static int dvb_ca_en50221_thread(void *data)
 static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
                                       unsigned int cmd, void *parg)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_ca_private *ca = dvbdev->priv;
         int err = 0;
         int slot;
 
@@ -1225,7 +1225,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
                 break;
 
         case CA_GET_CAP: {
-                struct ca_caps *caps = (struct ca_caps *) parg;
+                struct ca_caps *caps = parg;
 
                 caps->slot_num = ca->slot_count;
                 caps->slot_type = CA_CI_LINK;
@@ -1235,7 +1235,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
         }
 
         case CA_GET_SLOT_INFO: {
-                struct ca_slot_info *info = (struct ca_slot_info *) parg;
+                struct ca_slot_info *info = parg;
 
                 if ((info->num > ca->slot_count) || (info->num < 0))
                         return -EINVAL;
@@ -1291,8 +1291,8 @@ static int dvb_ca_en50221_io_ioctl(struct inode *inode, struct file *file,
 static ssize_t dvb_ca_en50221_io_write(struct file *file,
                                        const char __user * buf, size_t count, loff_t * ppos)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_ca_private *ca = dvbdev->priv;
         u8 slot, connection_id;
         int status;
         char fragbuf[HOST_LINK_BUF_SIZE];
@@ -1428,8 +1428,8 @@ static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca, int *resu
 static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user * buf,
                                       size_t count, loff_t * ppos)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_ca_private *ca = dvbdev->priv;
         int status;
         int result = 0;
         u8 hdr[2];
@@ -1526,8 +1526,8 @@ static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user * buf,
  */
 static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_ca_private *ca = dvbdev->priv;
         int err;
         int i;
 
@@ -1569,8 +1569,8 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
  */
 static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_ca_private *ca = dvbdev->priv;
         int err = 0;
 
         dprintk("%s\n", __FUNCTION__);
@@ -1597,8 +1597,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
  */
 static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table * wait)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_ca_private *ca = dvbdev->priv;
         unsigned int mask = 0;
         int slot;
         int result = 0;
@@ -1750,7 +1750,7 @@ EXPORT_SYMBOL(dvb_ca_en50221_release);
  */
 void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
 {
-        struct dvb_ca_private *ca = (struct dvb_ca_private *) pubca->private;
+        struct dvb_ca_private *ca = pubca->private;
         int i;
 
         dprintk("%s\n", __FUNCTION__);
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 59a9adfae1eb..d19301d90a09 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -48,7 +48,7 @@ static int dvb_override_tune_delay;
 static int dvb_powerdown_on_sleep = 1;
 
 module_param_named(frontend_debug, dvb_frontend_debug, int, 0644);
-MODULE_PARM_DESC(dvb_frontend_debug, "Turn on/off frontend core debugging (default:off).");
+MODULE_PARM_DESC(frontend_debug, "Turn on/off frontend core debugging (default:off).");
 module_param(dvb_shutdown_timeout, int, 0444);
 MODULE_PARM_DESC(dvb_shutdown_timeout, "wait <shutdown_timeout> seconds after close() before suspending hardware");
 module_param(dvb_force_auto_inversion, int, 0444);
@@ -117,7 +117,7 @@ struct dvb_frontend_private {
 
 static void dvb_frontend_add_event(struct dvb_frontend *fe, fe_status_t status)
 {
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         struct dvb_fe_events *events = &fepriv->events;
         struct dvb_frontend_event *e;
         int wp;
@@ -155,7 +155,7 @@ static void dvb_frontend_add_event(struct dvb_frontend *fe, fe_status_t status)
 static int dvb_frontend_get_event(struct dvb_frontend *fe,
                             struct dvb_frontend_event *event, int flags)
 {
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         struct dvb_fe_events *events = &fepriv->events;
 
         dprintk ("%s\n", __FUNCTION__);
@@ -234,7 +234,7 @@ static int dvb_frontend_autotune(struct dvb_frontend *fe, int check_wrapped)
 {
         int autoinversion;
         int ready = 0;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         int original_inversion = fepriv->parameters.inversion;
         u32 original_frequency = fepriv->parameters.frequency;
 
@@ -321,7 +321,7 @@ static int dvb_frontend_autotune(struct dvb_frontend *fe, int check_wrapped)
 
 static int dvb_frontend_is_exiting(struct dvb_frontend *fe)
 {
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         if (fepriv->exit)
                 return 1;
@@ -335,7 +335,7 @@ static int dvb_frontend_is_exiting(struct dvb_frontend *fe)
 
 static int dvb_frontend_should_wakeup(struct dvb_frontend *fe)
 {
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         if (fepriv->wakeup) {
                 fepriv->wakeup = 0;
@@ -346,7 +346,7 @@ static int dvb_frontend_should_wakeup(struct dvb_frontend *fe)
 
 static void dvb_frontend_wakeup(struct dvb_frontend *fe)
 {
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         fepriv->wakeup = 1;
         wake_up_interruptible(&fepriv->wait_queue);
@@ -357,8 +357,8 @@ static void dvb_frontend_wakeup(struct dvb_frontend *fe)
  */
 static int dvb_frontend_thread(void *data)
 {
-        struct dvb_frontend *fe = (struct dvb_frontend *) data;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend *fe = data;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         unsigned long timeout;
         char name [15];
         int quality = 0, delay = 3*HZ;
@@ -520,7 +520,7 @@ static int dvb_frontend_thread(void *data)
 static void dvb_frontend_stop(struct dvb_frontend *fe)
 {
         unsigned long ret;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         dprintk ("%s\n", __FUNCTION__);
 
@@ -559,7 +559,7 @@ static void dvb_frontend_stop(struct dvb_frontend *fe)
 static int dvb_frontend_start(struct dvb_frontend *fe)
 {
         int ret;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         dprintk ("%s\n", __FUNCTION__);
 
@@ -597,7 +597,7 @@ static int dvb_frontend_ioctl(struct inode *inode, struct file *file,
 {
         struct dvb_device *dvbdev = file->private_data;
         struct dvb_frontend *fe = dvbdev->priv;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         int err = -EOPNOTSUPP;
 
         dprintk ("%s\n", __FUNCTION__);
@@ -615,7 +615,7 @@ static int dvb_frontend_ioctl(struct inode *inode, struct file *file,
 
         switch (cmd) {
         case FE_GET_INFO: {
-                struct dvb_frontend_info* info = (struct dvb_frontend_info*) parg;
+                struct dvb_frontend_info* info = parg;
                 memcpy(info, &fe->ops->info, sizeof(struct dvb_frontend_info));
 
                 /* Force the CAN_INVERSION_AUTO bit on. If the frontend doesn't
@@ -793,7 +793,7 @@ static unsigned int dvb_frontend_poll(struct file *file, struct poll_table_struc
 {
         struct dvb_device *dvbdev = file->private_data;
         struct dvb_frontend *fe = dvbdev->priv;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         dprintk ("%s\n", __FUNCTION__);
 
@@ -809,7 +809,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
 {
         struct dvb_device *dvbdev = file->private_data;
         struct dvb_frontend *fe = dvbdev->priv;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         int ret;
 
         dprintk ("%s\n", __FUNCTION__);
@@ -833,7 +833,7 @@ static int dvb_frontend_release(struct inode *inode, struct file *file)
 {
         struct dvb_device *dvbdev = file->private_data;
         struct dvb_frontend *fe = dvbdev->priv;
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
 
         dprintk ("%s\n", __FUNCTION__);
 
@@ -873,7 +873,7 @@ int dvb_register_frontend(struct dvb_adapter* dvb,
                 up(&frontend_mutex);
                 return -ENOMEM;
         }
-        fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        fepriv = fe->frontend_priv;
         memset(fe->frontend_priv, 0, sizeof(struct dvb_frontend_private));
 
         init_MUTEX (&fepriv->sem);
@@ -897,7 +897,7 @@ EXPORT_SYMBOL(dvb_register_frontend);
 
 int dvb_unregister_frontend(struct dvb_frontend* fe)
 {
-        struct dvb_frontend_private *fepriv = (struct dvb_frontend_private*) fe->frontend_priv;
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
         dprintk ("%s\n", __FUNCTION__);
 
         down (&frontend_mutex);
diff --git a/drivers/media/dvb/dvb-core/dvb_net.c b/drivers/media/dvb/dvb-core/dvb_net.c
index 44892e7abd3d..6a968c346a36 100644
--- a/drivers/media/dvb/dvb-core/dvb_net.c
+++ b/drivers/media/dvb/dvb-core/dvb_net.c
@@ -315,7 +315,7 @@ static inline void reset_ule( struct dvb_net_priv *p )
  */
 static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv *)dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
         unsigned long skipped = 0L;
         u8 *ts, *ts_end, *from_where = NULL, ts_remain = 0, how_much = 0, new_ts = 1;
         struct ethhdr *ethh = NULL;
@@ -709,7 +709,7 @@ static int dvb_net_ts_callback(const u8 *buffer1, size_t buffer1_len,
                                const u8 *buffer2, size_t buffer2_len,
                                struct dmx_ts_feed *feed, enum dmx_success success)
 {
-        struct net_device *dev = (struct net_device *)feed->priv;
+        struct net_device *dev = feed->priv;
 
         if (buffer2 != 0)
                 printk(KERN_WARNING "buffer2 not 0: %p.\n", buffer2);
@@ -727,6 +727,7 @@ static void dvb_net_sec(struct net_device *dev, u8 *pkt, int pkt_len)
         u8 *eth;
         struct sk_buff *skb;
         struct net_device_stats *stats = &(((struct dvb_net_priv *) dev->priv)->stats);
+        int snap = 0;
 
         /* note: pkt_len includes a 32bit checksum */
         if (pkt_len < 16) {
@@ -750,9 +751,12 @@ static void dvb_net_sec(struct net_device *dev, u8 *pkt, int pkt_len)
                 return;
         }
         if (pkt[5] & 0x02) {
-                //FIXME: handle LLC/SNAP
-                stats->rx_dropped++;
-                return;
+                /* handle LLC/SNAP, see rfc-1042 */
+                if (pkt_len < 24 || memcmp(&pkt[12], "\xaa\xaa\x03\0\0\0", 6)) {
+                        stats->rx_dropped++;
+                        return;
+                }
+                snap = 8;
         }
         if (pkt[7]) {
                 /* FIXME: assemble datagram from multiple sections */
@@ -762,9 +766,9 @@ static void dvb_net_sec(struct net_device *dev, u8 *pkt, int pkt_len)
         }
 
         /* we have 14 byte ethernet header (ip header follows);
-         * 12 byte MPE header; 4 byte checksum; + 2 byte alignment
+         * 12 byte MPE header; 4 byte checksum; + 2 byte alignment, 8 byte LLC/SNAP
          */
-        if (!(skb = dev_alloc_skb(pkt_len - 4 - 12 + 14 + 2))) {
+        if (!(skb = dev_alloc_skb(pkt_len - 4 - 12 + 14 + 2 - snap))) {
                 //printk(KERN_NOTICE "%s: Memory squeeze, dropping packet.\n", dev->name);
                 stats->rx_dropped++;
                 return;
@@ -773,8 +777,8 @@ static void dvb_net_sec(struct net_device *dev, u8 *pkt, int pkt_len)
         skb->dev = dev;
 
         /* copy L3 payload */
-        eth = (u8 *) skb_put(skb, pkt_len - 12 - 4 + 14);
-        memcpy(eth + 14, pkt + 12, pkt_len - 12 - 4);
+        eth = (u8 *) skb_put(skb, pkt_len - 12 - 4 + 14 - snap);
+        memcpy(eth + 14, pkt + 12 + snap, pkt_len - 12 - 4 - snap);
 
         /* create ethernet header: */
         eth[0]=pkt[0x0b];
@@ -786,8 +790,21 @@ static void dvb_net_sec(struct net_device *dev, u8 *pkt, int pkt_len)
 
         eth[6]=eth[7]=eth[8]=eth[9]=eth[10]=eth[11]=0;
 
-        eth[12] = 0x08; /* ETH_P_IP */
-        eth[13] = 0x00;
+        if (snap) {
+                eth[12] = pkt[18];
+                eth[13] = pkt[19];
+        } else {
+                /* protocol numbers are from rfc-1700 or
+                 * http://www.iana.org/assignments/ethernet-numbers
+                 */
+                if (pkt[12] >> 4 == 6) { /* version field from IP header */
+                        eth[12] = 0x86; /* IPv6 */
+                        eth[13] = 0xdd;
+                } else {
+                        eth[12] = 0x08; /* IPv4 */
+                        eth[13] = 0x00;
+                }
+        }
 
         skb->protocol = dvb_net_eth_type_trans(skb, dev);
 
@@ -801,7 +818,7 @@ static int dvb_net_sec_callback(const u8 *buffer1, size_t buffer1_len,
                  struct dmx_section_filter *filter,
                  enum dmx_success success)
 {
-        struct net_device *dev=(struct net_device *) filter->priv;
+        struct net_device *dev = filter->priv;
 
         /**
          * we rely on the DVB API definition where exactly one complete
@@ -826,7 +843,7 @@ static int dvb_net_filter_sec_set(struct net_device *dev,
                    struct dmx_section_filter **secfilter,
                    u8 *mac, u8 *mac_mask)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
         int ret;
 
         *secfilter=NULL;
@@ -870,7 +887,7 @@ static int dvb_net_filter_sec_set(struct net_device *dev,
 static int dvb_net_feed_start(struct net_device *dev)
 {
         int ret, i;
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
         struct dmx_demux *demux = priv->demux;
         unsigned char *mac = (unsigned char *) dev->dev_addr;
 
@@ -965,7 +982,7 @@ static int dvb_net_feed_start(struct net_device *dev)
 
 static int dvb_net_feed_stop(struct net_device *dev)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
         int i;
 
         dprintk("%s\n", __FUNCTION__);
@@ -1016,7 +1033,7 @@ static int dvb_net_feed_stop(struct net_device *dev)
 
 static int dvb_set_mc_filter (struct net_device *dev, struct dev_mc_list *mc)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
 
         if (priv->multi_num == DVB_NET_MULTICAST_MAX)
                 return -ENOMEM;
@@ -1031,7 +1048,7 @@ static int dvb_set_mc_filter (struct net_device *dev, struct dev_mc_list *mc)
 static void wq_set_multicast_list (void *data)
 {
         struct net_device *dev = data;
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
 
         dvb_net_feed_stop(dev);
 
@@ -1066,7 +1083,7 @@ static void wq_set_multicast_list (void *data)
 
 static void dvb_net_set_multicast_list (struct net_device *dev)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
         schedule_work(&priv->set_multicast_list_wq);
 }
 
@@ -1084,7 +1101,7 @@ static void wq_restart_net_feed (void *data)
 
 static int dvb_net_set_mac (struct net_device *dev, void *p)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
         struct sockaddr *addr=p;
 
         memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
@@ -1098,7 +1115,7 @@ static int dvb_net_set_mac (struct net_device *dev, void *p)
 
 static int dvb_net_open(struct net_device *dev)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
 
         priv->in_use++;
         dvb_net_feed_start(dev);
@@ -1108,7 +1125,7 @@ static int dvb_net_open(struct net_device *dev)
 
 static int dvb_net_stop(struct net_device *dev)
 {
-        struct dvb_net_priv *priv = (struct dvb_net_priv*) dev->priv;
+        struct dvb_net_priv *priv = dev->priv;
 
         priv->in_use--;
         return dvb_net_feed_stop(dev);
@@ -1228,8 +1245,8 @@ static int dvb_net_remove_if(struct dvb_net *dvbnet, unsigned int num)
 static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
                   unsigned int cmd, void *parg)
 {
-        struct dvb_device *dvbdev = (struct dvb_device *) file->private_data;
-        struct dvb_net *dvbnet = (struct dvb_net *) dvbdev->priv;
+        struct dvb_device *dvbdev = file->private_data;
+        struct dvb_net *dvbnet = dvbdev->priv;
 
         if (((file->f_flags&O_ACCMODE)==O_RDONLY))
                 return -EPERM;
@@ -1237,7 +1254,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
         switch (cmd) {
         case NET_ADD_IF:
         {
-                struct dvb_net_if *dvbnetif=(struct dvb_net_if *)parg;
+                struct dvb_net_if *dvbnetif = parg;
                 int result;
 
                 if (!capable(CAP_SYS_ADMIN))
@@ -1258,7 +1275,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
         {
                 struct net_device *netdev;
                 struct dvb_net_priv *priv_data;
-                struct dvb_net_if *dvbnetif=(struct dvb_net_if *)parg;
+                struct dvb_net_if *dvbnetif = parg;
 
                 if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX ||
                     !dvbnet->state[dvbnetif->if_num])
@@ -1266,7 +1283,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
 
                 netdev = dvbnet->device[dvbnetif->if_num];
 
-                priv_data=(struct dvb_net_priv*)netdev->priv;
+                priv_data = netdev->priv;
                 dvbnetif->pid=priv_data->pid;
                 dvbnetif->feedtype=priv_data->feedtype;
                 break;
@@ -1288,7 +1305,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
         /* binary compatiblity cruft */
         case __NET_ADD_IF_OLD:
         {
-                struct __dvb_net_if_old *dvbnetif=(struct __dvb_net_if_old *)parg;
+                struct __dvb_net_if_old *dvbnetif = parg;
                 int result;
 
                 if (!capable(CAP_SYS_ADMIN))
@@ -1309,7 +1326,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
         {
                 struct net_device *netdev;
                 struct dvb_net_priv *priv_data;
-                struct __dvb_net_if_old *dvbnetif=(struct __dvb_net_if_old *)parg;
+                struct __dvb_net_if_old *dvbnetif = parg;
 
                 if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX ||
                     !dvbnet->state[dvbnetif->if_num])
@@ -1317,7 +1334,7 @@ static int dvb_net_do_ioctl(struct inode *inode, struct file *file,
 
                 netdev = dvbnet->device[dvbnetif->if_num];
 
-                priv_data=(struct dvb_net_priv*)netdev->priv;
+                priv_data = netdev->priv;
                 dvbnetif->pid=priv_data->pid;
                 break;
         }
diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
index cf4ffe38fda3..9d9662f4b8e6 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.c
+++ b/drivers/media/dvb/dvb-core/dvbdev.c
@@ -286,9 +286,8 @@ skip:
 }
 
 
-int dvb_register_adapter(struct dvb_adapter **padap, const char *name, struct module *module)
+int dvb_register_adapter(struct dvb_adapter *adap, const char *name, struct module *module)
 {
-        struct dvb_adapter *adap;
         int num;
 
         if (down_interruptible (&dvbdev_register_lock))
@@ -299,11 +298,6 @@ int dvb_register_adapter(struct dvb_adapter **padap, const char *name, struct mo
                 return -ENFILE;
         }
 
-        if (!(*padap = adap = kmalloc(sizeof(struct dvb_adapter), GFP_KERNEL))) {
-                up(&dvbdev_register_lock);
-                return -ENOMEM;
-        }
-
         memset (adap, 0, sizeof(struct dvb_adapter));
         INIT_LIST_HEAD (&adap->device_list);
 
@@ -331,7 +325,6 @@ int dvb_unregister_adapter(struct dvb_adapter *adap)
                 return -ERESTARTSYS;
         list_del (&adap->list_head);
         up (&dvbdev_register_lock);
-        kfree (adap);
         return 0;
 }
 EXPORT_SYMBOL(dvb_unregister_adapter);
diff --git a/drivers/media/dvb/dvb-core/dvbdev.h b/drivers/media/dvb/dvb-core/dvbdev.h
index 184edba3caa7..a251867f30f1 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.h
+++ b/drivers/media/dvb/dvb-core/dvbdev.h
@@ -76,7 +76,7 @@ struct dvb_device {
 };
 
 
-extern int dvb_register_adapter (struct dvb_adapter **padap, const char *name, struct module *module);
+extern int dvb_register_adapter (struct dvb_adapter *adap, const char *name, struct module *module);
 extern int dvb_unregister_adapter (struct dvb_adapter *adap);
 
 extern int dvb_register_device (struct dvb_adapter *adap,
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index 0bfd4df17d08..75fb556ec01f 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -12,10 +12,10 @@ config DVB_STV0299
 
 config DVB_CX24110
         tristate "Conexant CX24110 based"
-        depends on DVB_CORE
-        help
+        depends on DVB_CORE
+        help
           A DVB-S tuner module. Say Y when you want to support this frontend.
- 
+
 config DVB_TDA8083
         tristate "Philips TDA8083 based"
         depends on DVB_CORE
@@ -127,8 +127,8 @@ comment "DVB-C (cable) frontends"
 config DVB_ATMEL_AT76C651
         tristate "Atmel AT76C651 based"
         depends on DVB_CORE
-        help
-          A DVB-C tuner module. Say Y when you want to support this frontend.
+        help
+          A DVB-C tuner module. Say Y when you want to support this frontend.
 
 config DVB_VES1820
         tristate "VLSI VES1820 based"
@@ -158,10 +158,6 @@ config DVB_NXT2002
         help
           An ATSC 8VSB tuner module. Say Y when you want to support this frontend.
 
-config DVB_OR51132
-        tristate "OR51132 based (pcHDTV)"
-        depends on DVB_CORE
-
 config DVB_OR51211
         tristate "or51211 based (pcHDTV HD2000 card)"
         depends on DVB_CORE
@@ -169,4 +165,12 @@ config DVB_OR51211
         help
           An ATSC 8VSB tuner module. Say Y when you want to support this frontend.
 
+config DVB_OR51132
+        tristate "OR51132 based (pcHDTV HD3000 card)"
+        depends on DVB_CORE
+        select FW_LOADER
+        help
+          An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
+          to support this frontend.
+
 endmenu
diff --git a/drivers/media/dvb/frontends/at76c651.c b/drivers/media/dvb/frontends/at76c651.c
index ce2eaa1640e8..72a2b5455b0b 100644
--- a/drivers/media/dvb/frontends/at76c651.c
+++ b/drivers/media/dvb/frontends/at76c651.c
@@ -259,7 +259,7 @@ static int at76c651_set_parameters(struct dvb_frontend* fe,
                                    struct dvb_frontend_parameters *p)
 {
         int ret;
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
 
         at76c651_writereg(state, 0x0c, 0xc3);
         state->config->pll_set(fe, p);
@@ -276,7 +276,7 @@ static int at76c651_set_parameters(struct dvb_frontend* fe,
 
 static int at76c651_set_defaults(struct dvb_frontend* fe)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
 
         at76c651_set_symbol_rate(state, 6900000);
         at76c651_set_qam(state, QAM_64);
@@ -294,7 +294,7 @@ static int at76c651_set_defaults(struct dvb_frontend* fe)
 
 static int at76c651_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
         u8 sync;
 
         /*
@@ -319,7 +319,7 @@ static int at76c651_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int at76c651_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
 
         *ber = (at76c651_readreg(state, 0x81) & 0x0F) << 16;
         *ber |= at76c651_readreg(state, 0x82) << 8;
@@ -331,7 +331,7 @@ static int at76c651_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int at76c651_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
 
         u8 gain = ~at76c651_readreg(state, 0x91);
         *strength = (gain << 8) | gain;
@@ -341,7 +341,7 @@ static int at76c651_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int at76c651_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
 
         *snr = 0xFFFF -
             ((at76c651_readreg(state, 0x8F) << 8) |
@@ -352,7 +352,7 @@ static int at76c651_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int at76c651_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
 
         *ucblocks = at76c651_readreg(state, 0x82);
 
@@ -369,7 +369,7 @@ static int at76c651_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronte
 
 static void at76c651_release(struct dvb_frontend* fe)
 {
-        struct at76c651_state* state = (struct at76c651_state*) fe->demodulator_priv;
+        struct at76c651_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -381,7 +381,7 @@ struct dvb_frontend* at76c651_attach(const struct at76c651_config* config,
         struct at76c651_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct at76c651_state*) kmalloc(sizeof(struct at76c651_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct at76c651_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx22700.c b/drivers/media/dvb/frontends/cx22700.c
index a212279042b8..0c2ed4438618 100644
--- a/drivers/media/dvb/frontends/cx22700.c
+++ b/drivers/media/dvb/frontends/cx22700.c
@@ -232,7 +232,7 @@ static int cx22700_get_tps (struct cx22700_state* state, struct dvb_ofdm_paramet
 
 static int cx22700_init (struct dvb_frontend* fe)
 
-{       struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+{       struct cx22700_state* state = fe->demodulator_priv;
         int i;
 
         dprintk("cx22700_init: init chip\n");
@@ -258,7 +258,7 @@ static int cx22700_init (struct dvb_frontend* fe)
 
 static int cx22700_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
 
         u16 rs_ber = (cx22700_readreg (state, 0x0d) << 9)
                    | (cx22700_readreg (state, 0x0e) << 1);
@@ -286,7 +286,7 @@ static int cx22700_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int cx22700_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
 
         *ber = cx22700_readreg (state, 0x0c) & 0x7f;
         cx22700_writereg (state, 0x0c, 0x00);
@@ -296,7 +296,7 @@ static int cx22700_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int cx22700_read_signal_strength(struct dvb_frontend* fe, u16* signal_strength)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
 
         u16 rs_ber = (cx22700_readreg (state, 0x0d) << 9)
                    | (cx22700_readreg (state, 0x0e) << 1);
@@ -307,7 +307,7 @@ static int cx22700_read_signal_strength(struct dvb_frontend* fe, u16* signal_str
 
 static int cx22700_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
 
         u16 rs_ber = (cx22700_readreg (state, 0x0d) << 9)
                    | (cx22700_readreg (state, 0x0e) << 1);
@@ -318,7 +318,7 @@ static int cx22700_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int cx22700_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
 
         *ucblocks = cx22700_readreg (state, 0x0f);
         cx22700_writereg (state, 0x0f, 0x00);
@@ -328,7 +328,7 @@ static int cx22700_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int cx22700_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
 
         cx22700_writereg (state, 0x00, 0x02); /* XXX CHECKME: soft reset*/
         cx22700_writereg (state, 0x00, 0x00);
@@ -346,7 +346,7 @@ static int cx22700_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int cx22700_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
         u8 reg09 = cx22700_readreg (state, 0x09);
 
         p->inversion = reg09 & 0x1 ? INVERSION_ON : INVERSION_OFF;
@@ -363,7 +363,7 @@ static int cx22700_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronten
 
 static void cx22700_release(struct dvb_frontend* fe)
 {
-        struct cx22700_state* state = (struct cx22700_state*) fe->demodulator_priv;
+        struct cx22700_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -375,7 +375,7 @@ struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
         struct cx22700_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct cx22700_state*) kmalloc(sizeof(struct cx22700_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct cx22700_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx22702.c b/drivers/media/dvb/frontends/cx22702.c
index 011860ce36cc..f4aa44136c7c 100644
--- a/drivers/media/dvb/frontends/cx22702.c
+++ b/drivers/media/dvb/frontends/cx22702.c
@@ -200,7 +200,7 @@ static int cx22702_get_tps (struct cx22702_state *state, struct dvb_ofdm_paramet
 static int cx22702_set_tps (struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
         u8 val;
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         /* set PLL */
         cx22702_writereg (state, 0x0D, cx22702_readreg(state,0x0D) &0xfe);
@@ -338,7 +338,7 @@ static int cx22702_set_tps (struct dvb_frontend* fe, struct dvb_frontend_paramet
 static int cx22702_init (struct dvb_frontend* fe)
 {
         int i;
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         cx22702_writereg (state, 0x00, 0x02);
 
@@ -360,7 +360,7 @@ static int cx22702_init (struct dvb_frontend* fe)
 
 static int cx22702_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
         u8 reg0A;
         u8 reg23;
 
@@ -389,7 +389,7 @@ static int cx22702_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int cx22702_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         if(cx22702_readreg (state, 0xE4) & 0x02) {
                 /* Realtime statistics */
@@ -406,7 +406,7 @@ static int cx22702_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int cx22702_read_signal_strength(struct dvb_frontend* fe, u16* signal_strength)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         *signal_strength = cx22702_readreg (state, 0x23);
 
@@ -415,7 +415,7 @@ static int cx22702_read_signal_strength(struct dvb_frontend* fe, u16* signal_str
 
 static int cx22702_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         u16 rs_ber=0;
         if(cx22702_readreg (state, 0xE4) & 0x02) {
@@ -434,7 +434,7 @@ static int cx22702_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int cx22702_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         u8 _ucblocks;
 
@@ -449,7 +449,7 @@ static int cx22702_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int cx22702_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
 
         u8 reg0C = cx22702_readreg (state, 0x0C);
 
@@ -459,7 +459,7 @@ static int cx22702_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static void cx22702_release(struct dvb_frontend* fe)
 {
-        struct cx22702_state* state = (struct cx22702_state*) fe->demodulator_priv;
+        struct cx22702_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -471,7 +471,7 @@ struct dvb_frontend* cx22702_attach(const struct cx22702_config* config,
         struct cx22702_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct cx22702_state*) kmalloc(sizeof(struct cx22702_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct cx22702_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx24110.c b/drivers/media/dvb/frontends/cx24110.c
index ae16112a0653..8222b88cb486 100644
--- a/drivers/media/dvb/frontends/cx24110.c
+++ b/drivers/media/dvb/frontends/cx24110.c
@@ -315,7 +315,7 @@ dprintk("cx24110 debug: entering %s(%d)\n",__FUNCTION__,srate);
 
 int cx24110_pll_write (struct dvb_frontend* fe, u32 data)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
 /* tuner data is 21 bits long, must be left-aligned in data */
 /* tuner cx24108 is written through a dedicated 3wire interface on the demod chip */
@@ -356,7 +356,7 @@ int cx24110_pll_write (struct dvb_frontend* fe, u32 data)
 
 static int cx24110_initfe(struct dvb_frontend* fe)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 /* fixme (low): error handling */
         int i;
 
@@ -373,7 +373,7 @@ static int cx24110_initfe(struct dvb_frontend* fe)
 
 static int cx24110_set_voltage (struct dvb_frontend* fe, fe_sec_voltage_t voltage)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         switch (voltage) {
         case SEC_VOLTAGE_13:
@@ -385,8 +385,7 @@ static int cx24110_set_voltage (struct dvb_frontend* fe, fe_sec_voltage_t voltag
         };
 }
 
-static int cx24110_diseqc_send_burst(struct dvb_frontend* fe,
-                        fe_sec_mini_cmd_t burst)
+static int cx24110_diseqc_send_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t burst)
 {
         int rv, bit, i;
         struct cx24110_state *state = fe->demodulator_priv;
@@ -413,7 +412,7 @@ static int cx24110_send_diseqc_msg(struct dvb_frontend* fe,
                                    struct dvb_diseqc_master_cmd *cmd)
 {
         int i, rv;
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         for (i = 0; i < cmd->msg_len; i++)
                 cx24110_writereg(state, 0x79 + i, cmd->msg[i]);
@@ -432,7 +431,7 @@ static int cx24110_send_diseqc_msg(struct dvb_frontend* fe,
 
 static int cx24110_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         int sync = cx24110_readreg (state, 0x55);
 
@@ -460,7 +459,7 @@ static int cx24110_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int cx24110_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         /* fixme (maybe): value range is 16 bit. Scale? */
         if(cx24110_readreg(state,0x24)&0x10) {
@@ -478,7 +477,7 @@ static int cx24110_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int cx24110_read_signal_strength(struct dvb_frontend* fe, u16* signal_strength)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
 /* no provision in hardware. Read the frontend AGC accumulator. No idea how to scale this, but I know it is 2s complement */
         u8 signal = cx24110_readreg (state, 0x27)+128;
@@ -489,7 +488,7 @@ static int cx24110_read_signal_strength(struct dvb_frontend* fe, u16* signal_str
 
 static int cx24110_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         /* no provision in hardware. Can be computed from the Es/N0 estimator, but I don't know how. */
         if(cx24110_readreg(state,0x6a)&0x80) {
@@ -505,7 +504,7 @@ static int cx24110_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int cx24110_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
         u32 lastbyer;
 
         if(cx24110_readreg(state,0x10)&0x40) {
@@ -527,7 +526,7 @@ static int cx24110_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int cx24110_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         state->config->pll_set(fe, p);
         cx24110_set_inversion (state, p->inversion);
@@ -540,7 +539,7 @@ static int cx24110_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int cx24110_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
         s32 afc; unsigned sclk;
 
 /* cannot read back tuner settings (freq). Need to have some private storage */
@@ -567,14 +566,14 @@ static int cx24110_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int cx24110_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
 {
-        struct cx24110_state *state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state *state = fe->demodulator_priv;
 
         return cx24110_writereg(state,0x76,(cx24110_readreg(state,0x76)&~0x10)|(((tone==SEC_TONE_ON))?0x10:0));
 }
 
 static void cx24110_release(struct dvb_frontend* fe)
 {
-        struct cx24110_state* state = (struct cx24110_state*) fe->demodulator_priv;
+        struct cx24110_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -587,7 +586,7 @@ struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
         int ret;
 
         /* allocate memory for the internal state */
-        state = (struct cx24110_state*) kmalloc(sizeof(struct cx24110_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct cx24110_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/dib3000mb.c b/drivers/media/dvb/frontends/dib3000mb.c
index a853d12a26f1..6f52d649e97e 100644
--- a/drivers/media/dvb/frontends/dib3000mb.c
+++ b/drivers/media/dvb/frontends/dib3000mb.c
@@ -56,12 +56,12 @@ static int dib3000mb_get_frontend(struct dvb_frontend* fe,
 static int dib3000mb_set_frontend(struct dvb_frontend* fe,
                                   struct dvb_frontend_parameters *fep, int tuner)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         struct dvb_ofdm_parameters *ofdm = &fep->u.ofdm;
         fe_code_rate_t fe_cr = FEC_NONE;
         int search_state, seq;
 
-        if (tuner) {
+        if (tuner && state->config.pll_addr && state->config.pll_set) {
                 dib3000mb_tuner_pass_ctrl(fe,1,state->config.pll_addr(fe));
                 state->config.pll_set(fe, fep, NULL);
                 dib3000mb_tuner_pass_ctrl(fe,0,state->config.pll_addr(fe));
@@ -317,7 +317,7 @@ static int dib3000mb_set_frontend(struct dvb_frontend* fe,
 
 static int dib3000mb_fe_init(struct dvb_frontend* fe, int mobile_mode)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         deb_info("dib3000mb is getting up.\n");
         wr(DIB3000MB_REG_POWER_CONTROL, DIB3000MB_POWER_UP);
@@ -401,7 +401,7 @@ static int dib3000mb_fe_init(struct dvb_frontend* fe, int mobile_mode)
 static int dib3000mb_get_frontend(struct dvb_frontend* fe,
                                   struct dvb_frontend_parameters *fep)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         struct dvb_ofdm_parameters *ofdm = &fep->u.ofdm;
         fe_code_rate_t *cr;
         u16 tps_val;
@@ -562,7 +562,7 @@ static int dib3000mb_get_frontend(struct dvb_frontend* fe,
 
 static int dib3000mb_read_status(struct dvb_frontend* fe, fe_status_t *stat)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         *stat = 0;
 
@@ -594,7 +594,7 @@ static int dib3000mb_read_status(struct dvb_frontend* fe, fe_status_t *stat)
 
 static int dib3000mb_read_ber(struct dvb_frontend* fe, u32 *ber)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         *ber = ((rd(DIB3000MB_REG_BER_MSB) << 16) | rd(DIB3000MB_REG_BER_LSB));
         return 0;
@@ -603,7 +603,7 @@ static int dib3000mb_read_ber(struct dvb_frontend* fe, u32 *ber)
 /* see dib3000-watch dvb-apps for exact calcuations of signal_strength and snr */
 static int dib3000mb_read_signal_strength(struct dvb_frontend* fe, u16 *strength)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         *strength = rd(DIB3000MB_REG_SIGNAL_POWER) * 0xffff / 0x170;
         return 0;
@@ -611,7 +611,7 @@ static int dib3000mb_read_signal_strength(struct dvb_frontend* fe, u16 *strength
 
 static int dib3000mb_read_snr(struct dvb_frontend* fe, u16 *snr)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         short sigpow = rd(DIB3000MB_REG_SIGNAL_POWER);
         int icipow = ((rd(DIB3000MB_REG_NOISE_POWER_MSB) & 0xff) << 16) |
                 rd(DIB3000MB_REG_NOISE_POWER_LSB);
@@ -621,7 +621,7 @@ static int dib3000mb_read_snr(struct dvb_frontend* fe, u16 *snr)
 
 static int dib3000mb_read_unc_blocks(struct dvb_frontend* fe, u32 *unc)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         *unc = rd(DIB3000MB_REG_UNC);
         return 0;
@@ -629,7 +629,7 @@ static int dib3000mb_read_unc_blocks(struct dvb_frontend* fe, u32 *unc)
 
 static int dib3000mb_sleep(struct dvb_frontend* fe)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         deb_info("dib3000mb is going to bed.\n");
         wr(DIB3000MB_REG_POWER_CONTROL, DIB3000MB_POWER_DOWN);
         return 0;
@@ -656,7 +656,7 @@ static int dib3000mb_set_frontend_and_tuner(struct dvb_frontend* fe, struct dvb_
 
 static void dib3000mb_release(struct dvb_frontend* fe)
 {
-        struct dib3000_state *state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state *state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -671,7 +671,7 @@ static int dib3000mb_pid_control(struct dvb_frontend *fe,int index, int pid,int
 
 static int dib3000mb_fifo_control(struct dvb_frontend *fe, int onoff)
 {
-        struct dib3000_state *state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state *state = fe->demodulator_priv;
 
         deb_xfer("%s fifo\n",onoff ? "enabling" : "disabling");
         if (onoff) {
@@ -692,7 +692,7 @@ static int dib3000mb_pid_parse(struct dvb_frontend *fe, int onoff)
 
 static int dib3000mb_tuner_pass_ctrl(struct dvb_frontend *fe, int onoff, u8 pll_addr)
 {
-        struct dib3000_state *state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state *state = fe->demodulator_priv;
         if (onoff) {
                 wr(DIB3000MB_REG_TUNER, DIB3000_TUNER_WRITE_ENABLE(pll_addr));
         } else {
@@ -709,7 +709,7 @@ struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
         struct dib3000_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct dib3000_state*) kmalloc(sizeof(struct dib3000_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct dib3000_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
         memset(state,0,sizeof(struct dib3000_state));
diff --git a/drivers/media/dvb/frontends/dib3000mc.c b/drivers/media/dvb/frontends/dib3000mc.c
index 4a31c05eaecd..888f10a5e96b 100644
--- a/drivers/media/dvb/frontends/dib3000mc.c
+++ b/drivers/media/dvb/frontends/dib3000mc.c
@@ -297,7 +297,7 @@ static int dib3000mc_set_general_cfg(struct dib3000_state *state, struct dvb_fro
 static int dib3000mc_get_frontend(struct dvb_frontend* fe,
                                   struct dvb_frontend_parameters *fep)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         struct dvb_ofdm_parameters *ofdm = &fep->u.ofdm;
         fe_code_rate_t *cr;
         u16 tps_val,cr_val;
@@ -458,12 +458,12 @@ static int dib3000mc_get_frontend(struct dvb_frontend* fe,
 static int dib3000mc_set_frontend(struct dvb_frontend* fe,
                                   struct dvb_frontend_parameters *fep, int tuner)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         struct dvb_ofdm_parameters *ofdm = &fep->u.ofdm;
         int search_state,auto_val;
         u16 val;
 
-        if (tuner) { /* initial call from dvb */
+        if (tuner && state->config.pll_addr && state->config.pll_set) { /* initial call from dvb */
                 dib3000mc_tuner_pass_ctrl(fe,1,state->config.pll_addr(fe));
                 state->config.pll_set(fe,fep,NULL);
                 dib3000mc_tuner_pass_ctrl(fe,0,state->config.pll_addr(fe));
@@ -659,7 +659,7 @@ static int dib3000mc_fe_init(struct dvb_frontend* fe, int mobile_mode)
 }
 static int dib3000mc_read_status(struct dvb_frontend* fe, fe_status_t *stat)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         u16 lock = rd(DIB3000MC_REG_LOCKING);
 
         *stat = 0;
@@ -679,14 +679,14 @@ static int dib3000mc_read_status(struct dvb_frontend* fe, fe_status_t *stat)
 
 static int dib3000mc_read_ber(struct dvb_frontend* fe, u32 *ber)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         *ber = ((rd(DIB3000MC_REG_BER_MSB) << 16) | rd(DIB3000MC_REG_BER_LSB));
         return 0;
 }
 
 static int dib3000mc_read_unc_blocks(struct dvb_frontend* fe, u32 *unc)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         *unc = rd(DIB3000MC_REG_PACKET_ERROR_COUNT);
         return 0;
@@ -695,7 +695,7 @@ static int dib3000mc_read_unc_blocks(struct dvb_frontend* fe, u32 *unc)
 /* see dib3000mb.c for calculation comments */
 static int dib3000mc_read_signal_strength(struct dvb_frontend* fe, u16 *strength)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         u16 val = rd(DIB3000MC_REG_SIGNAL_NOISE_LSB);
         *strength = (((val >> 6) & 0xff) << 8) + (val & 0x3f);
 
@@ -706,7 +706,7 @@ static int dib3000mc_read_signal_strength(struct dvb_frontend* fe, u16 *strength
 /* see dib3000mb.c for calculation comments */
 static int dib3000mc_read_snr(struct dvb_frontend* fe, u16 *snr)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
         u16 val = rd(DIB3000MC_REG_SIGNAL_NOISE_LSB),
                 val2 = rd(DIB3000MC_REG_SIGNAL_NOISE_MSB);
         u16 sig,noise;
@@ -726,7 +726,7 @@ static int dib3000mc_read_snr(struct dvb_frontend* fe, u16 *snr)
 
 static int dib3000mc_sleep(struct dvb_frontend* fe)
 {
-        struct dib3000_state* state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state* state = fe->demodulator_priv;
 
         set_or(DIB3000MC_REG_CLK_CFG_7,DIB3000MC_CLK_CFG_7_PWR_DOWN);
         wr(DIB3000MC_REG_CLK_CFG_1,DIB3000MC_CLK_CFG_1_POWER_DOWN);
@@ -756,7 +756,7 @@ static int dib3000mc_set_frontend_and_tuner(struct dvb_frontend* fe, struct dvb_
 
 static void dib3000mc_release(struct dvb_frontend* fe)
 {
-        struct dib3000_state *state = (struct dib3000_state *) fe->demodulator_priv;
+        struct dib3000_state *state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -771,7 +771,7 @@ static int dib3000mc_pid_control(struct dvb_frontend *fe,int index, int pid,int
 
 static int dib3000mc_fifo_control(struct dvb_frontend *fe, int onoff)
 {
-        struct dib3000_state *state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state *state = fe->demodulator_priv;
         u16 tmp = rd(DIB3000MC_REG_SMO_MODE);
 
         deb_xfer("%s fifo\n",onoff ? "enabling" : "disabling");
@@ -803,7 +803,7 @@ static int dib3000mc_pid_parse(struct dvb_frontend *fe, int onoff)
 
 static int dib3000mc_tuner_pass_ctrl(struct dvb_frontend *fe, int onoff, u8 pll_addr)
 {
-        struct dib3000_state *state = (struct dib3000_state*) fe->demodulator_priv;
+        struct dib3000_state *state = fe->demodulator_priv;
         if (onoff) {
                 wr(DIB3000MC_REG_TUNER, DIB3000_TUNER_WRITE_ENABLE(pll_addr));
         } else {
@@ -844,7 +844,7 @@ struct dvb_frontend* dib3000mc_attach(const struct dib3000_config* config,
         u16 devid;
 
         /* allocate memory for the internal state */
-        state = (struct dib3000_state*) kmalloc(sizeof(struct dib3000_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct dib3000_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
         memset(state,0,sizeof(struct dib3000_state));
diff --git a/drivers/media/dvb/frontends/dvb-pll.h b/drivers/media/dvb/frontends/dvb-pll.h
index 016c794a5677..c4c3c56c4a81 100644
--- a/drivers/media/dvb/frontends/dvb-pll.h
+++ b/drivers/media/dvb/frontends/dvb-pll.h
@@ -2,6 +2,9 @@
  * $Id: dvb-pll.h,v 1.2 2005/02/10 11:43:41 kraxel Exp $
  */
 
+#ifndef __DVB_PLL_H__
+#define __DVB_PLL_H__
+
 struct dvb_pll_desc {
         char *name;
         u32  min;
@@ -26,9 +29,4 @@ extern struct dvb_pll_desc dvb_pll_unknown_1;
 int dvb_pll_configure(struct dvb_pll_desc *desc, u8 *buf,
                       u32 freq, int bandwidth);
 
-/*
- * Local variables:
- * c-basic-offset: 8
- * compile-command: "make DVB=1"
- * End:
- */
+#endif
diff --git a/drivers/media/dvb/frontends/dvb_dummy_fe.c b/drivers/media/dvb/frontends/dvb_dummy_fe.c
index c05a9b05600c..cff93b9d8ab2 100644
--- a/drivers/media/dvb/frontends/dvb_dummy_fe.c
+++ b/drivers/media/dvb/frontends/dvb_dummy_fe.c
@@ -100,7 +100,7 @@ static int dvb_dummy_fe_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t vo
 
 static void dvb_dummy_fe_release(struct dvb_frontend* fe)
 {
-        struct dvb_dummy_fe_state* state = (struct dvb_dummy_fe_state*) fe->demodulator_priv;
+        struct dvb_dummy_fe_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -111,7 +111,7 @@ struct dvb_frontend* dvb_dummy_fe_ofdm_attach(void)
         struct dvb_dummy_fe_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct dvb_dummy_fe_state*) kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
@@ -134,7 +134,7 @@ struct dvb_frontend* dvb_dummy_fe_qpsk_attach()
         struct dvb_dummy_fe_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct dvb_dummy_fe_state*) kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
@@ -157,7 +157,7 @@ struct dvb_frontend* dvb_dummy_fe_qam_attach()
         struct dvb_dummy_fe_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct dvb_dummy_fe_state*) kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index 9ac95de9834d..031a1ddc7d11 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -121,7 +121,7 @@ static int reset_and_configure (struct l64781_state* state)
 
 static int apply_frontend_param (struct dvb_frontend* fe, struct dvb_frontend_parameters *param)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
         /* The coderates for FEC_NONE, FEC_4_5 and FEC_FEC_6_7 are arbitrary */
         static const u8 fec_tab[] = { 7, 0, 1, 2, 9, 3, 10, 4 };
         /* QPSK, QAM_16, QAM_64 */
@@ -234,7 +234,7 @@ static int apply_frontend_param (struct dvb_frontend* fe, struct dvb_frontend_pa
 
 static int get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters* param)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
         int tmp;
 
 
@@ -352,7 +352,7 @@ static int get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters*
 
 static int l64781_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
         int sync = l64781_readreg (state, 0x32);
         int gain = l64781_readreg (state, 0x0e);
 
@@ -381,7 +381,7 @@ static int l64781_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int l64781_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
 
         /*   XXX FIXME: set up counting period (reg 0x26...0x28)
          */
@@ -393,7 +393,7 @@ static int l64781_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int l64781_read_signal_strength(struct dvb_frontend* fe, u16* signal_strength)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
 
         u8 gain = l64781_readreg (state, 0x0e);
         *signal_strength = (gain << 8) | gain;
@@ -403,7 +403,7 @@ static int l64781_read_signal_strength(struct dvb_frontend* fe, u16* signal_stre
 
 static int l64781_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
 
         u8 avg_quality = 0xff - l64781_readreg (state, 0x33);
         *snr = (avg_quality << 8) | avg_quality; /* not exact, but...*/
@@ -413,7 +413,7 @@ static int l64781_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int l64781_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
 
         *ucblocks = l64781_readreg (state, 0x37)
            | (l64781_readreg (state, 0x38) << 8);
@@ -423,7 +423,7 @@ static int l64781_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int l64781_sleep(struct dvb_frontend* fe)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
 
         /* Power down */
         return l64781_writereg (state, 0x3e, 0x5a);
@@ -431,7 +431,7 @@ static int l64781_sleep(struct dvb_frontend* fe)
 
 static int l64781_init(struct dvb_frontend* fe)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
 
         reset_and_configure (state);
 
@@ -484,7 +484,7 @@ static int l64781_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend
 
 static void l64781_release(struct dvb_frontend* fe)
 {
-        struct l64781_state* state = (struct l64781_state*) fe->demodulator_priv;
+        struct l64781_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -501,7 +501,7 @@ struct dvb_frontend* l64781_attach(const struct l64781_config* config,
                            { .addr = config->demod_address, .flags = I2C_M_RD, .buf = b1, .len = 1 } };
 
         /* allocate memory for the internal state */
-        state = (struct l64781_state*) kmalloc(sizeof(struct l64781_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct l64781_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/mt312.c b/drivers/media/dvb/frontends/mt312.c
index 176a22e3441b..e455aecd76b2 100644
--- a/drivers/media/dvb/frontends/mt312.c
+++ b/drivers/media/dvb/frontends/mt312.c
@@ -226,7 +226,7 @@ static int mt312_get_code_rate(struct mt312_state* state, fe_code_rate_t *cr)
 
 static int mt312_initfe(struct dvb_frontend* fe)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 buf[2];
 
@@ -287,7 +287,7 @@ static int mt312_initfe(struct dvb_frontend* fe)
 static int mt312_send_master_cmd(struct dvb_frontend* fe,
                                  struct dvb_diseqc_master_cmd *c)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 diseqc_mode;
 
@@ -318,7 +318,7 @@ static int mt312_send_master_cmd(struct dvb_frontend* fe,
 
 static int mt312_send_burst(struct dvb_frontend* fe, const fe_sec_mini_cmd_t c)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         const u8 mini_tab[2] = { 0x02, 0x03 };
 
         int ret;
@@ -340,7 +340,7 @@ static int mt312_send_burst(struct dvb_frontend* fe, const fe_sec_mini_cmd_t c)
 
 static int mt312_set_tone(struct dvb_frontend* fe, const fe_sec_tone_mode_t t)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         const u8 tone_tab[2] = { 0x01, 0x00 };
 
         int ret;
@@ -362,7 +362,7 @@ static int mt312_set_tone(struct dvb_frontend* fe, const fe_sec_tone_mode_t t)
 
 static int mt312_set_voltage(struct dvb_frontend* fe, const fe_sec_voltage_t v)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         const u8 volt_tab[3] = { 0x00, 0x40, 0x00 };
 
         if (v > SEC_VOLTAGE_OFF)
@@ -373,7 +373,7 @@ static int mt312_set_voltage(struct dvb_frontend* fe, const fe_sec_voltage_t v)
 
 static int mt312_read_status(struct dvb_frontend* fe, fe_status_t *s)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 status[3];
 
@@ -400,7 +400,7 @@ static int mt312_read_status(struct dvb_frontend* fe, fe_status_t *s)
 
 static int mt312_read_ber(struct dvb_frontend* fe, u32 *ber)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 buf[3];
 
@@ -414,7 +414,7 @@ static int mt312_read_ber(struct dvb_frontend* fe, u32 *ber)
 
 static int mt312_read_signal_strength(struct dvb_frontend* fe, u16 *signal_strength)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 buf[3];
         u16 agc;
@@ -435,7 +435,7 @@ static int mt312_read_signal_strength(struct dvb_frontend* fe, u16 *signal_stren
 
 static int mt312_read_snr(struct dvb_frontend* fe, u16 *snr)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 buf[2];
 
@@ -449,7 +449,7 @@ static int mt312_read_snr(struct dvb_frontend* fe, u16 *snr)
 
 static int mt312_read_ucblocks(struct dvb_frontend* fe, u32 *ubc)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 buf[2];
 
@@ -464,7 +464,7 @@ static int mt312_read_ucblocks(struct dvb_frontend* fe, u32 *ubc)
 static int mt312_set_frontend(struct dvb_frontend* fe,
                               struct dvb_frontend_parameters *p)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 buf[5], config_val;
         u16 sr;
@@ -560,7 +560,7 @@ static int mt312_set_frontend(struct dvb_frontend* fe,
 static int mt312_get_frontend(struct dvb_frontend* fe,
                               struct dvb_frontend_parameters *p)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
 
         if ((ret = mt312_get_inversion(state, &p->inversion)) < 0)
@@ -577,7 +577,7 @@ static int mt312_get_frontend(struct dvb_frontend* fe,
 
 static int mt312_sleep(struct dvb_frontend* fe)
 {
-        struct mt312_state *state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state *state = fe->demodulator_priv;
         int ret;
         u8 config;
 
@@ -605,7 +605,7 @@ static int mt312_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_
 
 static void mt312_release(struct dvb_frontend* fe)
 {
-        struct mt312_state* state = (struct mt312_state*) fe->demodulator_priv;
+        struct mt312_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -617,7 +617,7 @@ struct dvb_frontend* vp310_attach(const struct mt312_config* config,
         struct mt312_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct mt312_state*) kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
@@ -651,7 +651,7 @@ struct dvb_frontend* mt312_attach(const struct mt312_config* config,
         struct mt312_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct mt312_state*) kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/mt352.c b/drivers/media/dvb/frontends/mt352.c
index 50326c7248fa..d32dc4de9e7f 100644
--- a/drivers/media/dvb/frontends/mt352.c
+++ b/drivers/media/dvb/frontends/mt352.c
@@ -46,7 +46,7 @@ struct mt352_state {
         struct dvb_frontend_ops ops;
 
         /* configuration settings */
-        const struct mt352_config* config;
+        struct mt352_config config;
 };
 
 static int debug;
@@ -59,7 +59,7 @@ static int mt352_single_write(struct dvb_frontend *fe, u8 reg, u8 val)
 {
         struct mt352_state* state = fe->demodulator_priv;
         u8 buf[2] = { reg, val };
-        struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0,
+        struct i2c_msg msg = { .addr = state->config.demod_address, .flags = 0,
                                .buf = buf, .len = 2 };
         int err = i2c_transfer(state->i2c, &msg, 1);
         if (err != 1) {
@@ -84,10 +84,10 @@ static int mt352_read_register(struct mt352_state* state, u8 reg)
         int ret;
         u8 b0 [] = { reg };
         u8 b1 [] = { 0 };
-        struct i2c_msg msg [] = { { .addr = state->config->demod_address,
+        struct i2c_msg msg [] = { { .addr = state->config.demod_address,
                                     .flags = 0,
                                     .buf = b0, .len = 1 },
-                                  { .addr = state->config->demod_address,
+                                  { .addr = state->config.demod_address,
                                     .flags = I2C_M_RD,
                                     .buf = b1, .len = 1 } };
 
@@ -102,11 +102,6 @@ static int mt352_read_register(struct mt352_state* state, u8 reg)
         return b1[0];
 }
 
-int mt352_read(struct dvb_frontend *fe, u8 reg)
-{
-        return mt352_read_register(fe->demodulator_priv,reg);
-}
-
 static int mt352_sleep(struct dvb_frontend* fe)
 {
         static u8 mt352_softdown[] = { CLOCK_CTL, 0x20, 0x08 };
@@ -134,8 +129,8 @@ static void mt352_calc_nominal_rate(struct mt352_state* state,
                 bw = 8;
                 break;
         }
-        if (state->config->adc_clock)
-                adc_clock = state->config->adc_clock;
+        if (state->config.adc_clock)
+                adc_clock = state->config.adc_clock;
 
         value = 64 * bw * (1<<16) / (7 * 8);
         value = value * 1000 / adc_clock;
@@ -152,10 +147,10 @@ static void mt352_calc_input_freq(struct mt352_state* state,
         int if2       = 36167; /* 36.166667 MHz */
         int ife,value;
 
-        if (state->config->adc_clock)
-                adc_clock = state->config->adc_clock;
-        if (state->config->if2)
-                if2 = state->config->if2;
+        if (state->config.adc_clock)
+                adc_clock = state->config.adc_clock;
+        if (state->config.if2)
+                if2 = state->config.if2;
 
         ife = (2*adc_clock - if2);
         value = -16374 * ife / adc_clock;
@@ -289,10 +284,10 @@ static int mt352_set_parameters(struct dvb_frontend* fe,
 
         mt352_calc_nominal_rate(state, op->bandwidth, buf+4);
         mt352_calc_input_freq(state, buf+6);
-        state->config->pll_set(fe, param, buf+8);
+        state->config.pll_set(fe, param, buf+8);
 
         mt352_write(fe, buf, sizeof(buf));
-        if (state->config->no_tuner) {
+        if (state->config.no_tuner) {
                 /* start decoding */
                 mt352_write(fe, fsm_go, 2);
         } else {
@@ -516,7 +511,7 @@ static int mt352_init(struct dvb_frontend* fe)
 
                 /* Do a "hard" reset */
                 mt352_write(fe, mt352_reset_attach, sizeof(mt352_reset_attach));
-                return state->config->demod_init(fe);
+                return state->config.demod_init(fe);
         }
 
         return 0;
@@ -541,8 +536,8 @@ struct dvb_frontend* mt352_attach(const struct mt352_config* config,
         memset(state,0,sizeof(*state));
 
         /* setup the state */
-        state->config = config;
         state->i2c = i2c;
+        memcpy(&state->config,config,sizeof(struct mt352_config));
         memcpy(&state->ops, &mt352_ops, sizeof(struct dvb_frontend_ops));
 
         /* check if the demod is there */
@@ -601,10 +596,3 @@ MODULE_LICENSE("GPL");
 
 EXPORT_SYMBOL(mt352_attach);
 EXPORT_SYMBOL(mt352_write);
-EXPORT_SYMBOL(mt352_read);
-/*
- * Local variables:
- * c-basic-offset: 8
- * compile-command: "make DVB=1"
- * End:
- */
diff --git a/drivers/media/dvb/frontends/mt352.h b/drivers/media/dvb/frontends/mt352.h
index f5d8a5aed8a9..03040cd595bb 100644
--- a/drivers/media/dvb/frontends/mt352.h
+++ b/drivers/media/dvb/frontends/mt352.h
@@ -61,12 +61,5 @@ extern struct dvb_frontend* mt352_attach(const struct mt352_config* config,
                                          struct i2c_adapter* i2c);
 
 extern int mt352_write(struct dvb_frontend* fe, u8* ibuf, int ilen);
-extern int mt352_read(struct dvb_frontend *fe, u8 reg);
 
 #endif // MT352_H
-
-/*
- * Local variables:
- * c-basic-offset: 8
- * End:
- */
diff --git a/drivers/media/dvb/frontends/nxt2002.c b/drivers/media/dvb/frontends/nxt2002.c
index 4743aa17406e..35a1d60f1927 100644
--- a/drivers/media/dvb/frontends/nxt2002.c
+++ b/drivers/media/dvb/frontends/nxt2002.c
@@ -241,7 +241,7 @@ static void nxt2002_agc_reset(struct nxt2002_state* state)
 static int nxt2002_load_firmware (struct dvb_frontend* fe, const struct firmware *fw)
 {
 
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u8 buf[256],written = 0,chunkpos = 0;
         u16 rambase,position,crc = 0;
 
@@ -309,7 +309,7 @@ static int nxt2002_load_firmware (struct dvb_frontend* fe, const struct firmware
 static int nxt2002_setup_frontend_parameters (struct dvb_frontend* fe,
                                              struct dvb_frontend_parameters *p)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u32 freq = 0;
         u16 tunerfreq = 0;
         u8 buf[4];
@@ -343,8 +343,6 @@ static int nxt2002_setup_frontend_parameters (struct dvb_frontend* fe,
         /* reset the agc now that tuning has been completed */
         nxt2002_agc_reset(state);
 
-
-
         /* set target power level */
         switch (p->u.vsb.modulation) {
                 case QAM_64:
@@ -453,7 +451,7 @@ static int nxt2002_setup_frontend_parameters (struct dvb_frontend* fe,
 
 static int nxt2002_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u8 lock;
         i2c_readbytes(state,0x31,&lock,1);
 
@@ -470,7 +468,7 @@ static int nxt2002_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int nxt2002_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u8 b[3];
 
         nxt2002_readreg_multibyte(state,0xE6,b,3);
@@ -482,7 +480,7 @@ static int nxt2002_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int nxt2002_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u8 b[2];
         u16 temp = 0;
 
@@ -502,7 +500,7 @@ static int nxt2002_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 static int nxt2002_read_snr(struct dvb_frontend* fe, u16* snr)
 {
 
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u8 b[2];
         u16 temp = 0, temp2;
         u32 snrdb = 0;
@@ -536,7 +534,7 @@ static int nxt2002_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int nxt2002_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         u8 b[3];
 
         nxt2002_readreg_multibyte(state,0xE6,b,3);
@@ -552,7 +550,7 @@ static int nxt2002_sleep(struct dvb_frontend* fe)
 
 static int nxt2002_init(struct dvb_frontend* fe)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         const struct firmware *fw;
         int ret;
         u8 buf[2];
@@ -624,7 +622,7 @@ static int nxt2002_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronten
 
 static void nxt2002_release(struct dvb_frontend* fe)
 {
-        struct nxt2002_state* state = (struct nxt2002_state*) fe->demodulator_priv;
+        struct nxt2002_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -637,7 +635,7 @@ struct dvb_frontend* nxt2002_attach(const struct nxt2002_config* config,
         u8 buf [] = {0,0,0,0,0};
 
         /* allocate memory for the internal state */
-        state = (struct nxt2002_state*) kmalloc(sizeof(struct nxt2002_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct nxt2002_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/nxt6000.c b/drivers/media/dvb/frontends/nxt6000.c
index a41f7da8b842..966de9853d18 100644
--- a/drivers/media/dvb/frontends/nxt6000.c
+++ b/drivers/media/dvb/frontends/nxt6000.c
@@ -176,11 +176,16 @@ static int nxt6000_set_transmission_mode(struct nxt6000_state* state, fe_transmi
 
 static void nxt6000_setup(struct dvb_frontend* fe)
 {
-        struct nxt6000_state* state = (struct nxt6000_state*) fe->demodulator_priv;
+        struct nxt6000_state* state = fe->demodulator_priv;
 
         nxt6000_writereg(state, RS_COR_SYNC_PARAM, SYNC_PARAM);
         nxt6000_writereg(state, BER_CTRL, /*(1 << 2) | */ (0x01 << 1) | 0x01);
-        nxt6000_writereg(state, VIT_COR_CTL, VIT_COR_RESYNC);
+        nxt6000_writereg(state, VIT_BERTIME_2, 0x00);  // BER Timer = 0x000200 * 256 = 131072 bits
+        nxt6000_writereg(state, VIT_BERTIME_1, 0x02);  //
+        nxt6000_writereg(state, VIT_BERTIME_0, 0x00);  //
+        nxt6000_writereg(state, VIT_COR_INTEN, 0x98); // Enable BER interrupts
+        nxt6000_writereg(state, VIT_COR_CTL, 0x82);   // Enable BER measurement
+        nxt6000_writereg(state, VIT_COR_CTL, VIT_COR_RESYNC | 0x02 );
         nxt6000_writereg(state, OFDM_COR_CTL, (0x01 << 5) | (nxt6000_readreg(state, OFDM_COR_CTL) & 0x0F));
         nxt6000_writereg(state, OFDM_COR_MODEGUARD, FORCEMODE8K | 0x02);
         nxt6000_writereg(state, OFDM_AGC_CTL, AGCLAST | INITIAL_AGC_BW);
@@ -422,7 +427,7 @@ static void nxt6000_dump_status(struct nxt6000_state *state)
 static int nxt6000_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
         u8 core_status;
-        struct nxt6000_state* state = (struct nxt6000_state*) fe->demodulator_priv;
+        struct nxt6000_state* state = fe->demodulator_priv;
 
         *status = 0;
 
@@ -451,7 +456,7 @@ static int nxt6000_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int nxt6000_init(struct dvb_frontend* fe)
 {
-        struct nxt6000_state* state = (struct nxt6000_state*) fe->demodulator_priv;
+        struct nxt6000_state* state = fe->demodulator_priv;
 
         nxt6000_reset(state);
         nxt6000_setup(fe);
@@ -461,7 +466,7 @@ static int nxt6000_init(struct dvb_frontend* fe)
 
 static int nxt6000_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *param)
 {
-        struct nxt6000_state* state = (struct nxt6000_state*) fe->demodulator_priv;
+        struct nxt6000_state* state = fe->demodulator_priv;
         int result;
 
         nxt6000_writereg(state, ENABLE_TUNER_IIC, 0x01);        /* open i2c bus switch */
@@ -482,10 +487,44 @@ static int nxt6000_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static void nxt6000_release(struct dvb_frontend* fe)
 {
-        struct nxt6000_state* state = (struct nxt6000_state*) fe->demodulator_priv;
+        struct nxt6000_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
+static int nxt6000_read_snr(struct dvb_frontend* fe, u16* snr)
+{
+        struct nxt6000_state* state = fe->demodulator_priv;
+
+        *snr = nxt6000_readreg( state, OFDM_CHC_SNR) / 8;
+
+        return 0;
+}
+
+static int nxt6000_read_ber(struct dvb_frontend* fe, u32* ber)
+{
+        struct nxt6000_state* state = fe->demodulator_priv;
+
+        nxt6000_writereg( state, VIT_COR_INTSTAT, 0x18 );
+
+        *ber = (nxt6000_readreg( state, VIT_BER_1 ) << 8 ) |
+                nxt6000_readreg( state, VIT_BER_0 );
+
+        nxt6000_writereg( state, VIT_COR_INTSTAT, 0x18); // Clear BER Done interrupts
+
+        return 0;
+}
+
+static int nxt6000_read_signal_strength(struct dvb_frontend* fe, u16* signal_strength)
+{
+        struct nxt6000_state* state = fe->demodulator_priv;
+
+        *signal_strength = (short) (511 -
+                (nxt6000_readreg(state, AGC_GAIN_1) +
+                ((nxt6000_readreg(state, AGC_GAIN_2) & 0x03) << 8)));
+
+        return 0;
+}
+
 static struct dvb_frontend_ops nxt6000_ops;
 
 struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
@@ -494,7 +533,7 @@ struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
         struct nxt6000_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct nxt6000_state*) kmalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
@@ -542,6 +581,9 @@ static struct dvb_frontend_ops nxt6000_ops = {
         .set_frontend = nxt6000_set_frontend,
 
         .read_status = nxt6000_read_status,
+        .read_ber = nxt6000_read_ber,
+        .read_signal_strength = nxt6000_read_signal_strength,
+        .read_snr = nxt6000_read_snr,
 };
 
 module_param(debug, int, 0644);
diff --git a/drivers/media/dvb/frontends/nxt6000_priv.h b/drivers/media/dvb/frontends/nxt6000_priv.h
index 64b1a89b2a22..0422e580038a 100644
--- a/drivers/media/dvb/frontends/nxt6000_priv.h
+++ b/drivers/media/dvb/frontends/nxt6000_priv.h
@@ -65,12 +65,27 @@
 #define BER_DONE               (0x08)
 #define BER_OVERFLOW           (0x10)
 
+/* 0x38 VIT_BERTIME_2 */
+#define VIT_BERTIME_2      (0x38)
+
+/* 0x39 VIT_BERTIME_1 */
+#define VIT_BERTIME_1      (0x39)
+
+/* 0x3A VIT_BERTIME_0 */
+#define VIT_BERTIME_0      (0x3a)
+
                              /* 0x38 OFDM_BERTimer *//* Use the alias registers */
 #define A_VIT_BER_TIMER_0      (0x1D)
 
                              /* 0x3A VIT_BER_TIMER_0 *//* Use the alias registers */
 #define A_VIT_BER_0            (0x1B)
 
+/* 0x3B VIT_BER_1 */
+#define VIT_BER_1              (0x3b)
+
+/* 0x3C VIT_BER_0 */
+#define VIT_BER_0              (0x3c)
+
 /* 0x40 OFDM_COR_CTL */
 #define OFDM_COR_CTL           (0x40)
 #define COREACT                (0x20)
@@ -117,6 +132,12 @@
 #define OFDM_ITB_CTL           (0x4B)
 #define ITBINV                 (0x01)
 
+/* 0x49 AGC_GAIN_1 */
+#define AGC_GAIN_1             (0x49)
+
+/* 0x4A AGC_GAIN_2 */
+#define AGC_GAIN_2             (0x4A)
+
 /* 0x4C OFDM_ITB_FREQ_1 */
 #define OFDM_ITB_FREQ_1        (0x4C)
 
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index df5dee7760a3..cc0a77c790f1 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -102,7 +102,7 @@ static u8 i2c_readbytes (struct or51132_state* state, u8 reg, u8* buf, int len)
 
 static int or51132_load_firmware (struct dvb_frontend* fe, const struct firmware *fw)
 {
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         static u8 run_buf[] = {0x7F,0x01};
         static u8 get_ver_buf[] = {0x04,0x00,0x30,0x00,0x00};
         u8 rec_buf[14];
@@ -240,7 +240,7 @@ static int or51132_sleep(struct dvb_frontend* fe)
 
 static int or51132_setmode(struct dvb_frontend* fe)
 {
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         unsigned char cmd_buf[4];
 
         dprintk("setmode %d\n",(int)state->current_modulation);
@@ -316,7 +316,7 @@ static int or51132_set_parameters(struct dvb_frontend* fe,
 {
         int ret;
         u8 buf[4];
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         const struct firmware *fw;
 
         /* Change only if we are actually changing the modulation */
@@ -391,7 +391,7 @@ static int or51132_set_parameters(struct dvb_frontend* fe,
 
 static int or51132_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         unsigned char rec_buf[2];
         unsigned char snd_buf[2];
         *status = 0;
@@ -464,7 +464,7 @@ static unsigned int i20Log10(unsigned short val)
 
 static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         unsigned char rec_buf[2];
         unsigned char snd_buf[2];
         u8 rcvr_stat;
@@ -512,7 +512,7 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int or51132_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         unsigned char rec_buf[2];
         unsigned char snd_buf[2];
         u16 snr_equ;
@@ -549,7 +549,7 @@ static int or51132_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronten
 
 static void or51132_release(struct dvb_frontend* fe)
 {
-        struct or51132_state* state = (struct or51132_state*) fe->demodulator_priv;
+        struct or51132_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 58ad34ef0a00..764a95a2e212 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -248,7 +248,7 @@ static int sp8870_wake_up(struct sp8870_state* state)
 static int sp8870_set_frontend_parameters (struct dvb_frontend* fe,
                                            struct dvb_frontend_parameters *p)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         int  err;
         u16 reg0xc05;
 
@@ -302,7 +302,7 @@ static int sp8870_set_frontend_parameters (struct dvb_frontend* fe,
 
 static int sp8870_init (struct dvb_frontend* fe)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         const struct firmware *fw = NULL;
 
         sp8870_wake_up(state);
@@ -358,7 +358,7 @@ static int sp8870_init (struct dvb_frontend* fe)
 
 static int sp8870_read_status (struct dvb_frontend* fe, fe_status_t * fe_status)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         int status;
         int signal;
 
@@ -384,7 +384,7 @@ static int sp8870_read_status (struct dvb_frontend* fe, fe_status_t * fe_status)
 
 static int sp8870_read_ber (struct dvb_frontend* fe, u32 * ber)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         int ret;
         u32 tmp;
 
@@ -412,7 +412,7 @@ static int sp8870_read_ber (struct dvb_frontend* fe, u32 * ber)
 
 static int sp8870_read_signal_strength(struct dvb_frontend* fe,  u16 * signal)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         int ret;
         u16 tmp;
 
@@ -438,7 +438,7 @@ static int sp8870_read_signal_strength(struct dvb_frontend* fe,  u16 * signal)
 
 static int sp8870_read_uncorrected_blocks (struct dvb_frontend* fe, u32* ublocks)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         int ret;
 
         *ublocks = 0;
@@ -467,7 +467,7 @@ static int switches = 0;
 
 static int sp8870_set_frontend (struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
 
         /*
             The firmware of the sp8870 sometimes locks up after setting frontend parameters.
@@ -524,7 +524,7 @@ static int sp8870_set_frontend (struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int sp8870_sleep(struct dvb_frontend* fe)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
 
         // tristate TS output and disable interface pins
         return sp8870_writereg(state, 0xC18, 0x000);
@@ -540,7 +540,7 @@ static int sp8870_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend
 
 static void sp8870_release(struct dvb_frontend* fe)
 {
-        struct sp8870_state* state = (struct sp8870_state*) fe->demodulator_priv;
+        struct sp8870_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -552,7 +552,7 @@ struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
         struct sp8870_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct sp8870_state*) kmalloc(sizeof(struct sp8870_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct sp8870_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index 7eae833ece49..d868a6927a16 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -135,7 +135,7 @@ static void sp887x_setup_agc (struct sp887x_state* state)
  */
 static int sp887x_initial_setup (struct dvb_frontend* fe, const struct firmware *fw)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
         u8 buf [BLOCKSIZE+2];
         int i;
         int fw_size = fw->size;
@@ -344,7 +344,7 @@ static void sp887x_correct_offsets (struct sp887x_state* state,
 static int sp887x_setup_frontend_parameters (struct dvb_frontend* fe,
                                              struct dvb_frontend_parameters *p)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
         int actual_freq, err;
         u16 val, reg0xc05;
 
@@ -405,7 +405,7 @@ static int sp887x_setup_frontend_parameters (struct dvb_frontend* fe,
 
 static int sp887x_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
         u16 snr12 = sp887x_readreg(state, 0xf16);
         u16 sync0x200 = sp887x_readreg(state, 0x200);
         u16 sync0xf17 = sp887x_readreg(state, 0xf17);
@@ -439,7 +439,7 @@ static int sp887x_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int sp887x_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
 
         *ber = (sp887x_readreg(state, 0xc08) & 0x3f) |
                (sp887x_readreg(state, 0xc07) << 6);
@@ -453,7 +453,7 @@ static int sp887x_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int sp887x_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
 
         u16 snr12 = sp887x_readreg(state, 0xf16);
         u32 signal = 3 * (snr12 << 4);
@@ -464,7 +464,7 @@ static int sp887x_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int sp887x_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
 
         u16 snr12 = sp887x_readreg(state, 0xf16);
         *snr = (snr12 << 4) | (snr12 >> 8);
@@ -474,7 +474,7 @@ static int sp887x_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int sp887x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
 
         *ucblocks = sp887x_readreg(state, 0xc0c);
         if (*ucblocks == 0xfff)
@@ -485,7 +485,7 @@ static int sp887x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int sp887x_sleep(struct dvb_frontend* fe)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
 
         /* tristate TS output and disable interface pins */
         sp887x_writereg(state, 0xc18, 0x000);
@@ -495,7 +495,7 @@ static int sp887x_sleep(struct dvb_frontend* fe)
 
 static int sp887x_init(struct dvb_frontend* fe)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
         const struct firmware *fw = NULL;
         int ret;
 
@@ -534,7 +534,7 @@ static int sp887x_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend
 
 static void sp887x_release(struct dvb_frontend* fe)
 {
-        struct sp887x_state* state = (struct sp887x_state*) fe->demodulator_priv;
+        struct sp887x_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -546,7 +546,7 @@ struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
         struct sp887x_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct sp887x_state*) kmalloc(sizeof(struct sp887x_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct sp887x_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/stv0297.c b/drivers/media/dvb/frontends/stv0297.c
index 502c6403dfc6..e681263bf079 100644
--- a/drivers/media/dvb/frontends/stv0297.c
+++ b/drivers/media/dvb/frontends/stv0297.c
@@ -365,7 +365,7 @@ static int stv0297_set_inversion(struct stv0297_state *state, fe_spectral_invers
 
 int stv0297_enable_plli2c(struct dvb_frontend *fe)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
 
         stv0297_writereg(state, 0x87, 0x78);
         stv0297_writereg(state, 0x86, 0xc8);
@@ -375,7 +375,7 @@ int stv0297_enable_plli2c(struct dvb_frontend *fe)
 
 static int stv0297_init(struct dvb_frontend *fe)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         int i;
 
         /* soft reset */
@@ -416,7 +416,7 @@ static int stv0297_init(struct dvb_frontend *fe)
 
 static int stv0297_sleep(struct dvb_frontend *fe)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
 
         stv0297_writereg_mask(state, 0x80, 1, 1);
 
@@ -425,7 +425,7 @@ static int stv0297_sleep(struct dvb_frontend *fe)
 
 static int stv0297_read_status(struct dvb_frontend *fe, fe_status_t * status)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
 
         u8 sync = stv0297_readreg(state, 0xDF);
 
@@ -438,7 +438,7 @@ static int stv0297_read_status(struct dvb_frontend *fe, fe_status_t * status)
 
 static int stv0297_read_ber(struct dvb_frontend *fe, u32 * ber)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         u8 BER[3];
 
         stv0297_writereg(state, 0xA0, 0x80);    // Start Counting bit errors for 4096 Bytes
@@ -453,7 +453,7 @@ static int stv0297_read_ber(struct dvb_frontend *fe, u32 * ber)
 
 static int stv0297_read_signal_strength(struct dvb_frontend *fe, u16 * strength)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         u8 STRENGTH[2];
 
         stv0297_readregs(state, 0x41, STRENGTH, 2);
@@ -464,7 +464,7 @@ static int stv0297_read_signal_strength(struct dvb_frontend *fe, u16 * strength)
 
 static int stv0297_read_snr(struct dvb_frontend *fe, u16 * snr)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         u8 SNR[2];
 
         stv0297_readregs(state, 0x07, SNR, 2);
@@ -475,7 +475,7 @@ static int stv0297_read_snr(struct dvb_frontend *fe, u16 * snr)
 
 static int stv0297_read_ucblocks(struct dvb_frontend *fe, u32 * ucblocks)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
 
         *ucblocks = (stv0297_readreg(state, 0xD5) << 8)
                 | stv0297_readreg(state, 0xD4);
@@ -485,7 +485,7 @@ static int stv0297_read_ucblocks(struct dvb_frontend *fe, u32 * ucblocks)
 
 static int stv0297_set_frontend(struct dvb_frontend *fe, struct dvb_frontend_parameters *p)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         int u_threshold;
         int initial_u;
         int blind_u;
@@ -689,7 +689,7 @@ timeout:
 
 static int stv0297_get_frontend(struct dvb_frontend *fe, struct dvb_frontend_parameters *p)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         int reg_00, reg_83;
 
         reg_00 = stv0297_readreg(state, 0x00);
@@ -725,7 +725,7 @@ static int stv0297_get_frontend(struct dvb_frontend *fe, struct dvb_frontend_par
 
 static void stv0297_release(struct dvb_frontend *fe)
 {
-        struct stv0297_state *state = (struct stv0297_state *) fe->demodulator_priv;
+        struct stv0297_state *state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -737,7 +737,7 @@ struct dvb_frontend *stv0297_attach(const struct stv0297_config *config,
         struct stv0297_state *state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct stv0297_state *) kmalloc(sizeof(struct stv0297_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct stv0297_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/stv0299.c b/drivers/media/dvb/frontends/stv0299.c
index 15b40541b62d..cfa3928bb487 100644
--- a/drivers/media/dvb/frontends/stv0299.c
+++ b/drivers/media/dvb/frontends/stv0299.c
@@ -70,6 +70,7 @@ struct stv0299_state {
 #define STATUS_UCBLOCKS 1
 
 static int debug;
+static int debug_legacy_dish_switch;
 #define dprintk(args...) \
         do { \
                 if (debug) printk(KERN_DEBUG "stv0299: " args); \
@@ -93,7 +94,7 @@ static int stv0299_writeregI (struct stv0299_state* state, u8 reg, u8 data)
 
 int stv0299_writereg (struct dvb_frontend* fe, u8 reg, u8 data)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         return stv0299_writeregI(state, reg, data);
 }
@@ -218,7 +219,7 @@ static int stv0299_wait_diseqc_idle (struct stv0299_state* state, int timeout)
 
 static int stv0299_set_symbolrate (struct dvb_frontend* fe, u32 srate)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         u64 big = srate;
         u32 ratio;
 
@@ -269,7 +270,7 @@ static int stv0299_get_symbolrate (struct stv0299_state* state)
 static int stv0299_send_diseqc_msg (struct dvb_frontend* fe,
                                     struct dvb_diseqc_master_cmd *m)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         u8 val;
         int i;
 
@@ -299,7 +300,7 @@ static int stv0299_send_diseqc_msg (struct dvb_frontend* fe,
 
 static int stv0299_send_diseqc_burst (struct dvb_frontend* fe, fe_sec_mini_cmd_t burst)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         u8 val;
 
         dprintk ("%s\n", __FUNCTION__);
@@ -326,7 +327,7 @@ static int stv0299_send_diseqc_burst (struct dvb_frontend* fe, fe_sec_mini_cmd_t
 
 static int stv0299_set_tone (struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         u8 val;
 
         if (stv0299_wait_diseqc_idle (state, 100) < 0)
@@ -348,7 +349,7 @@ static int stv0299_set_tone (struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
 
 static int stv0299_set_voltage (struct dvb_frontend* fe, fe_sec_voltage_t voltage)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         u8 reg0x08;
         u8 reg0x0c;
 
@@ -385,34 +386,84 @@ static int stv0299_set_voltage (struct dvb_frontend* fe, fe_sec_voltage_t voltag
         };
 }
 
-static int stv0299_send_legacy_dish_cmd(struct dvb_frontend* fe, u32 cmd)
+static inline s32 stv0299_calc_usec_delay (struct timeval lasttime, struct timeval curtime)
 {
+        return ((curtime.tv_usec < lasttime.tv_usec) ?
+                1000000 - lasttime.tv_usec + curtime.tv_usec :
+                curtime.tv_usec - lasttime.tv_usec);
+}
+
+static void stv0299_sleep_until (struct timeval *waketime, u32 add_usec)
+{
+        struct timeval lasttime;
+        s32 delta, newdelta;
+
+        waketime->tv_usec += add_usec;
+        if (waketime->tv_usec >= 1000000) {
+                waketime->tv_usec -= 1000000;
+                waketime->tv_sec++;
+        }
+
+        do_gettimeofday (&lasttime);
+        delta = stv0299_calc_usec_delay (lasttime, *waketime);
+        if (delta > 2500) {
+                msleep ((delta - 1500) / 1000);
+                do_gettimeofday (&lasttime);
+                newdelta = stv0299_calc_usec_delay (lasttime, *waketime);
+                delta = (newdelta > delta) ? 0 : newdelta;
+        }
+        if (delta > 0)
+                udelay (delta);
+}
+
+static int stv0299_send_legacy_dish_cmd (struct dvb_frontend* fe, u32 cmd)
+{
+        struct stv0299_state* state = fe->demodulator_priv;
+        u8 reg0x08;
+        u8 reg0x0c;
+        u8 lv_mask = 0x40;
         u8 last = 1;
         int i;
+        struct timeval nexttime;
+        struct timeval tv[10];
 
-        /* reset voltage at the end
-        if((0x50 & stv0299_readreg (i2c, 0x0c)) == 0x50)
-                cmd |= 0x80;
-        else
-                cmd &= 0x7F;
-        */
+        reg0x08 = stv0299_readreg (state, 0x08);
+        reg0x0c = stv0299_readreg (state, 0x0c);
+        reg0x0c &= 0x0f;
+        stv0299_writeregI (state, 0x08, (reg0x08 & 0x3f) | (state->config->lock_output << 6));
+        if (state->config->volt13_op0_op1 == STV0299_VOLT13_OP0)
+                lv_mask = 0x10;
 
         cmd = cmd << 1;
-        dprintk("%s switch command: 0x%04x\n",__FUNCTION__, cmd);
+        if (debug_legacy_dish_switch)
+                printk ("%s switch command: 0x%04x\n",__FUNCTION__, cmd);
+
+        do_gettimeofday (&nexttime);
+        if (debug_legacy_dish_switch)
+                memcpy (&tv[0], &nexttime, sizeof (struct timeval));
+        stv0299_writeregI (state, 0x0c, reg0x0c | 0x50); /* set LNB to 18V */
 
-        stv0299_set_voltage(fe,SEC_VOLTAGE_18);
-        msleep(32);
+        stv0299_sleep_until (&nexttime, 32000);
 
         for (i=0; i<9; i++) {
+                if (debug_legacy_dish_switch)
+                        do_gettimeofday (&tv[i+1]);
                 if((cmd & 0x01) != last) {
-                        stv0299_set_voltage(fe, last ? SEC_VOLTAGE_13 : SEC_VOLTAGE_18);
+                        /* set voltage to (last ? 13V : 18V) */
+                        stv0299_writeregI (state, 0x0c, reg0x0c | (last ? lv_mask : 0x50));
                         last = (last) ? 0 : 1;
                 }
 
                 cmd = cmd >> 1;
 
                 if (i != 8)
-                        msleep(8);
+                        stv0299_sleep_until (&nexttime, 8000);
+        }
+        if (debug_legacy_dish_switch) {
+                printk ("%s(%d): switch delay (should be 32k followed by all 8k\n",
+                        __FUNCTION__, fe->dvb->num);
+                for (i=1; i < 10; i++)
+                        printk ("%d: %d\n", i, stv0299_calc_usec_delay (tv[i-1] , tv[i]));
         }
 
         return 0;
@@ -420,7 +471,7 @@ static int stv0299_send_legacy_dish_cmd(struct dvb_frontend* fe, u32 cmd)
 
 static int stv0299_init (struct dvb_frontend* fe)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         int i;
 
         dprintk("stv0299: init chip\n");
@@ -439,7 +490,7 @@ static int stv0299_init (struct dvb_frontend* fe)
 
 static int stv0299_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         u8 signal = 0xff - stv0299_readreg (state, 0x18);
         u8 sync = stv0299_readreg (state, 0x1b);
@@ -467,7 +518,7 @@ static int stv0299_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int stv0299_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         if (state->errmode != STATUS_BER) return 0;
         *ber = (stv0299_readreg (state, 0x1d) << 8) | stv0299_readreg (state, 0x1e);
@@ -477,7 +528,7 @@ static int stv0299_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int stv0299_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         s32 signal =  0xffff - ((stv0299_readreg (state, 0x18) << 8)
                                | stv0299_readreg (state, 0x19));
@@ -494,7 +545,7 @@ static int stv0299_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int stv0299_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         s32 xsnr = 0xffff - ((stv0299_readreg (state, 0x24) << 8)
                            | stv0299_readreg (state, 0x25));
@@ -506,7 +557,7 @@ static int stv0299_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int stv0299_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         if (state->errmode != STATUS_UCBLOCKS) *ucblocks = 0;
         else *ucblocks = (stv0299_readreg (state, 0x1d) << 8) | stv0299_readreg (state, 0x1e);
@@ -516,7 +567,7 @@ static int stv0299_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int stv0299_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters * p)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         int invval = 0;
 
         dprintk ("%s : FE_SET_FRONTEND\n", __FUNCTION__);
@@ -584,7 +635,7 @@ static int stv0299_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int stv0299_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters * p)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         s32 derot_freq;
         int invval;
 
@@ -609,7 +660,7 @@ static int stv0299_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int stv0299_sleep(struct dvb_frontend* fe)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         stv0299_writeregI(state, 0x02, 0x80);
         state->initialised = 0;
@@ -619,7 +670,7 @@ static int stv0299_sleep(struct dvb_frontend* fe)
 
 static int stv0299_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings* fesettings)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
 
         fesettings->min_delay_ms = state->config->min_delay_ms;
         if (fesettings->parameters.u.qpsk.symbol_rate < 10000000) {
@@ -634,7 +685,7 @@ static int stv0299_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronten
 
 static void stv0299_release(struct dvb_frontend* fe)
 {
-        struct stv0299_state* state = (struct stv0299_state*) fe->demodulator_priv;
+        struct stv0299_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -647,7 +698,7 @@ struct dvb_frontend* stv0299_attach(const struct stv0299_config* config,
         int id;
 
         /* allocate memory for the internal state */
-        state = (struct stv0299_state*) kmalloc(sizeof(struct stv0299_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct stv0299_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
@@ -719,6 +770,9 @@ static struct dvb_frontend_ops stv0299_ops = {
         .dishnetwork_send_legacy_command = stv0299_send_legacy_dish_cmd,
 };
 
+module_param(debug_legacy_dish_switch, int, 0444);
+MODULE_PARM_DESC(debug_legacy_dish_switch, "Enable timing analysis for Dish Network legacy switches");
+
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
 
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index 4e40d95ee95d..87d5f4d8790f 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -205,7 +205,7 @@ static int tda10021_set_symbolrate (struct tda10021_state* state, u32 symbolrate
 
 static int tda10021_init (struct dvb_frontend *fe)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
         int i;
 
         dprintk("DVB: TDA10021(%d): init chip\n", fe->adapter->num);
@@ -238,7 +238,7 @@ static int tda10021_init (struct dvb_frontend *fe)
 static int tda10021_set_parameters (struct dvb_frontend *fe,
                             struct dvb_frontend_parameters *p)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
 
         //table for QAM4-QAM256 ready  QAM4  QAM16 QAM32 QAM64 QAM128 QAM256
         //CONF
@@ -278,7 +278,7 @@ static int tda10021_set_parameters (struct dvb_frontend *fe,
 
 static int tda10021_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
         int sync;
 
         *status = 0;
@@ -303,7 +303,7 @@ static int tda10021_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int tda10021_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
 
         u32 _ber = tda10021_readreg(state, 0x14) |
                 (tda10021_readreg(state, 0x15) << 8) |
@@ -315,7 +315,7 @@ static int tda10021_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int tda10021_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
 
         u8 gain = tda10021_readreg(state, 0x17);
         *strength = (gain << 8) | gain;
@@ -325,7 +325,7 @@ static int tda10021_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int tda10021_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
 
         u8 quality = ~tda10021_readreg(state, 0x18);
         *snr = (quality << 8) | quality;
@@ -335,7 +335,7 @@ static int tda10021_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int tda10021_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
 
         *ucblocks = tda10021_readreg (state, 0x13) & 0x7f;
         if (*ucblocks == 0x7f)
@@ -350,7 +350,7 @@ static int tda10021_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int tda10021_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
         int sync;
         s8 afc = 0;
 
@@ -378,7 +378,7 @@ static int tda10021_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_pa
 
 static int tda10021_sleep(struct dvb_frontend* fe)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
 
         tda10021_writereg (state, 0x1b, 0x02);  /* pdown ADC */
         tda10021_writereg (state, 0x00, 0x80);  /* standby */
@@ -388,7 +388,7 @@ static int tda10021_sleep(struct dvb_frontend* fe)
 
 static void tda10021_release(struct dvb_frontend* fe)
 {
-        struct tda10021_state* state = (struct tda10021_state*) fe->demodulator_priv;
+        struct tda10021_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -401,7 +401,7 @@ struct dvb_frontend* tda10021_attach(const struct tda10021_config* config,
         struct tda10021_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct tda10021_state*) kmalloc(sizeof(struct tda10021_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct tda10021_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 687ad9cf3384..0beb370792ae 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -35,9 +35,10 @@
 #include "dvb_frontend.h"
 #include "tda1004x.h"
 
-#define TDA1004X_DEMOD_TDA10045 0
-#define TDA1004X_DEMOD_TDA10046 1
-
+enum tda1004x_demod {
+        TDA1004X_DEMOD_TDA10045,
+        TDA1004X_DEMOD_TDA10046,
+};
 
 struct tda1004x_state {
         struct i2c_adapter* i2c;
@@ -46,8 +47,9 @@ struct tda1004x_state {
         struct dvb_frontend frontend;
 
         /* private demod data */
-        u8 initialised:1;
-        u8 demod_type;
+        u8 initialised;
+        enum tda1004x_demod demod_type;
+        u8 fw_version;
 };
 
 
@@ -139,7 +141,7 @@ static int tda1004x_write_byteI(struct tda1004x_state *state, int reg, int data)
 {
         int ret;
         u8 buf[] = { reg, data };
-        struct i2c_msg msg = { .addr=0, .flags=0, .buf=buf, .len=2 };
+        struct i2c_msg msg = { .flags = 0, .buf = buf, .len = 2 };
 
         dprintk("%s: reg=0x%x, data=0x%x\n", __FUNCTION__, reg, data);
 
@@ -160,8 +162,8 @@ static int tda1004x_read_byte(struct tda1004x_state *state, int reg)
         int ret;
         u8 b0[] = { reg };
         u8 b1[] = { 0 };
-        struct i2c_msg msg[] = {{ .addr=0, .flags=0, .buf=b0, .len=1},
-                                { .addr=0, .flags=I2C_M_RD, .buf=b1, .len = 1}};
+        struct i2c_msg msg[] = {{ .flags = 0, .buf = b0, .len = 1 },
+                                { .flags = I2C_M_RD, .buf = b1, .len = 1 }};
 
         dprintk("%s: reg=0x%x\n", __FUNCTION__, reg);
 
@@ -294,7 +296,7 @@ static int tda1004x_do_upload(struct tda1004x_state *state,
                               u8 dspCodeCounterReg, u8 dspCodeInReg)
 {
         u8 buf[65];
-        struct i2c_msg fw_msg = {.addr = 0,.flags = 0,.buf = buf,.len = 0 };
+        struct i2c_msg fw_msg = { .flags = 0, .buf = buf, .len = 0 };
         int tx_size;
         int pos = 0;
 
@@ -304,12 +306,10 @@ static int tda1004x_do_upload(struct tda1004x_state *state,
 
         buf[0] = dspCodeInReg;
         while (pos != len) {
-
                 // work out how much to send this time
                 tx_size = len - pos;
-                if (tx_size > 0x10) {
+                if (tx_size > 0x10)
                         tx_size = 0x10;
-                }
 
                 // send the chunk
                 memcpy(buf + 1, mem + pos, tx_size);
@@ -322,6 +322,7 @@ static int tda1004x_do_upload(struct tda1004x_state *state,
 
                 dprintk("%s: fw_pos=0x%x\n", __FUNCTION__, pos);
         }
+
         return 0;
 }
 
@@ -335,9 +336,8 @@ static int tda1004x_check_upload_ok(struct tda1004x_state *state, u8 dspVersion)
 
         data1 = tda1004x_read_byte(state, TDA1004X_DSP_DATA1);
         data2 = tda1004x_read_byte(state, TDA1004X_DSP_DATA2);
-        if (data1 != 0x67 || data2 != dspVersion) {
+        if ((data1 != 0x67) || (data2 != dspVersion))
                 return -EIO;
-        }
 
         return 0;
 }
@@ -348,9 +348,9 @@ static int tda10045_fwupload(struct dvb_frontend* fe)
         int ret;
         const struct firmware *fw;
 
-
         /* don't re-upload unless necessary */
-        if (tda1004x_check_upload_ok(state, 0x2c) == 0) return 0;
+        if (tda1004x_check_upload_ok(state, 0x2c) == 0)
+                return 0;
 
         /* request the firmware, this will block until someone uploads it */
         printk("tda1004x: waiting for firmware upload (%s)...\n", TDA10045_DEFAULT_FIRMWARE);
@@ -381,6 +381,25 @@ static int tda10045_fwupload(struct dvb_frontend* fe)
         return tda1004x_check_upload_ok(state, 0x2c);
 }
 
+static int tda10046_get_fw_version(struct tda1004x_state *state,
+                                   const struct firmware *fw)
+{
+        const unsigned char pattern[] = { 0x67, 0x00, 0x50, 0x62, 0x5e, 0x18, 0x67 };
+        unsigned int i;
+
+        /* area guessed from firmware v20, v21 and v25 */
+        for (i = 0x660; i < 0x700; i++) {
+                if (!memcmp(&fw->data[i], pattern, sizeof(pattern))) {
+                        state->fw_version = fw->data[i + sizeof(pattern)];
+                        printk(KERN_INFO "tda1004x: using firmware v%02x\n",
+                                        state->fw_version);
+                        return 0;
+                }
+        }
+
+        return -EINVAL;
+}
+
 static int tda10046_fwupload(struct dvb_frontend* fe)
 {
         struct tda1004x_state* state = fe->demodulator_priv;
@@ -394,7 +413,8 @@ static int tda10046_fwupload(struct dvb_frontend* fe)
         msleep(100);
 
         /* don't re-upload unless necessary */
-        if (tda1004x_check_upload_ok(state, 0x20) == 0) return 0;
+        if (tda1004x_check_upload_ok(state, state->fw_version) == 0)
+                return 0;
 
         /* request the firmware, this will block until someone uploads it */
         printk("tda1004x: waiting for firmware upload (%s)...\n", TDA10046_DEFAULT_FIRMWARE);
@@ -404,9 +424,20 @@ static int tda10046_fwupload(struct dvb_frontend* fe)
                 return ret;
         }
 
+        if (fw->size < 24478) { /* size of firmware v20, which is the smallest of v20, v21 and v25 */
+                printk("tda1004x: firmware file seems to be too small (%d bytes)\n", fw->size);
+                return -EINVAL;
+        }
+
+        ret = tda10046_get_fw_version(state, fw);
+        if (ret < 0) {
+                printk("tda1004x: unable to find firmware version\n");
+                return ret;
+        }
+
         /* set parameters */
         tda1004x_write_byteI(state, TDA10046H_CONFPLL2, 10);
-        tda1004x_write_byteI(state, TDA10046H_CONFPLL3, 0);
+        tda1004x_write_byteI(state, TDA10046H_CONFPLL3, state->config->n_i2c);
         tda1004x_write_byteI(state, TDA10046H_FREQ_OFFSET, 99);
         tda1004x_write_byteI(state, TDA10046H_FREQ_PHY2_MSB, 0xd4);
         tda1004x_write_byteI(state, TDA10046H_FREQ_PHY2_LSB, 0x2c);
@@ -419,7 +450,7 @@ static int tda10046_fwupload(struct dvb_frontend* fe)
 
         /* wait for DSP to initialise */
         timeout = jiffies + HZ;
-        while(!(tda1004x_read_byte(state, TDA1004X_STATUS_CD) & 0x20)) {
+        while (!(tda1004x_read_byte(state, TDA1004X_STATUS_CD) & 0x20)) {
                 if (time_after(jiffies, timeout)) {
                         printk("tda1004x: DSP failed to initialised.\n");
                         return -EIO;
@@ -427,7 +458,7 @@ static int tda10046_fwupload(struct dvb_frontend* fe)
                 msleep(1);
         }
 
-        return tda1004x_check_upload_ok(state, 0x20);
+        return tda1004x_check_upload_ok(state, state->fw_version);
 }
 
 static int tda1004x_encode_fec(int fec)
@@ -483,7 +514,8 @@ static int tda10045_init(struct dvb_frontend* fe)
 
         dprintk("%s\n", __FUNCTION__);
 
-        if (state->initialised) return 0;
+        if (state->initialised)
+                return 0;
 
         if (tda10045_fwupload(fe)) {
                 printk("tda1004x: firmware upload failed\n");
@@ -523,7 +555,8 @@ static int tda10046_init(struct dvb_frontend* fe)
         struct tda1004x_state* state = fe->demodulator_priv;
         dprintk("%s\n", __FUNCTION__);
 
-        if (state->initialised) return 0;
+        if (state->initialised)
+                return 0;
 
         if (tda10046_fwupload(fe)) {
                 printk("tda1004x: firmware upload failed\n");
@@ -545,7 +578,7 @@ static int tda10046_init(struct dvb_frontend* fe)
         tda1004x_write_mask(state, TDA1004X_AUTO, 8, 0); // select HP stream
         tda1004x_write_mask(state, TDA1004X_CONFC1, 0x80, 0); // disable pulse killer
         tda1004x_write_byteI(state, TDA10046H_CONFPLL2, 10); // PLL M = 10
-        tda1004x_write_byteI(state, TDA10046H_CONFPLL3, 0); // PLL P = N = 0
+        tda1004x_write_byteI(state, TDA10046H_CONFPLL3, state->config->n_i2c); // PLL P = N = 0
         tda1004x_write_byteI(state, TDA10046H_FREQ_OFFSET, 99); // FREQOFFS = 99
         tda1004x_write_byteI(state, TDA10046H_FREQ_PHY2_MSB, 0xd4); // } PHY2 = -11221
         tda1004x_write_byteI(state, TDA10046H_FREQ_PHY2_LSB, 0x2c); // }
@@ -621,12 +654,14 @@ static int tda1004x_set_fe(struct dvb_frontend* fe,
 
                 // set HP FEC
                 tmp = tda1004x_encode_fec(fe_params->u.ofdm.code_rate_HP);
-                if (tmp < 0) return tmp;
+                if (tmp < 0)
+                        return tmp;
                 tda1004x_write_mask(state, TDA1004X_IN_CONF2, 7, tmp);
 
                 // set LP FEC
                 tmp = tda1004x_encode_fec(fe_params->u.ofdm.code_rate_LP);
-                if (tmp < 0) return tmp;
+                if (tmp < 0)
+                        return tmp;
                 tda1004x_write_mask(state, TDA1004X_IN_CONF2, 0x38, tmp << 3);
 
                 // set constellation
@@ -671,7 +706,7 @@ static int tda1004x_set_fe(struct dvb_frontend* fe,
         }
 
         // set bandwidth
-        switch(state->demod_type) {
+        switch (state->demod_type) {
         case TDA1004X_DEMOD_TDA10045:
                 tda10045h_set_bandwidth(state, fe_params->u.ofdm.bandwidth);
                 break;
@@ -683,7 +718,8 @@ static int tda1004x_set_fe(struct dvb_frontend* fe,
 
         // set inversion
         inversion = fe_params->inversion;
-        if (state->config->invert) inversion = inversion ? INVERSION_OFF : INVERSION_ON;
+        if (state->config->invert)
+                inversion = inversion ? INVERSION_OFF : INVERSION_ON;
         switch (inversion) {
         case INVERSION_OFF:
                 tda1004x_write_mask(state, TDA1004X_CONFC1, 0x20, 0);
@@ -750,19 +786,19 @@ static int tda1004x_set_fe(struct dvb_frontend* fe,
         }
 
         // start the lock
-        switch(state->demod_type) {
+        switch (state->demod_type) {
         case TDA1004X_DEMOD_TDA10045:
                 tda1004x_write_mask(state, TDA1004X_CONFC4, 8, 8);
                 tda1004x_write_mask(state, TDA1004X_CONFC4, 8, 0);
-                msleep(10);
                 break;
 
         case TDA1004X_DEMOD_TDA10046:
                 tda1004x_write_mask(state, TDA1004X_AUTO, 0x40, 0x40);
-                msleep(10);
                 break;
         }
 
+        msleep(10);
+
         return 0;
 }
 
@@ -773,13 +809,13 @@ static int tda1004x_get_fe(struct dvb_frontend* fe, struct dvb_frontend_paramete
 
         // inversion status
         fe_params->inversion = INVERSION_OFF;
-        if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20) {
+        if (tda1004x_read_byte(state, TDA1004X_CONFC1) & 0x20)
                 fe_params->inversion = INVERSION_ON;
-        }
-        if (state->config->invert) fe_params->inversion = fe_params->inversion ? INVERSION_OFF : INVERSION_ON;
+        if (state->config->invert)
+                fe_params->inversion = fe_params->inversion ? INVERSION_OFF : INVERSION_ON;
 
         // bandwidth
-        switch(state->demod_type) {
+        switch (state->demod_type) {
         case TDA1004X_DEMOD_TDA10045:
                 switch (tda1004x_read_byte(state, TDA10045H_WREF_LSB)) {
                 case 0x14:
@@ -830,9 +866,8 @@ static int tda1004x_get_fe(struct dvb_frontend* fe, struct dvb_frontend_paramete
 
         // transmission mode
         fe_params->u.ofdm.transmission_mode = TRANSMISSION_MODE_2K;
-        if (tda1004x_read_byte(state, TDA1004X_OUT_CONF1) & 0x10) {
+        if (tda1004x_read_byte(state, TDA1004X_OUT_CONF1) & 0x10)
                 fe_params->u.ofdm.transmission_mode = TRANSMISSION_MODE_8K;
-        }
 
         // guard interval
         switch ((tda1004x_read_byte(state, TDA1004X_OUT_CONF1) & 0x0c) >> 2) {
@@ -880,30 +915,33 @@ static int tda1004x_read_status(struct dvb_frontend* fe, fe_status_t * fe_status
 
         // read status
         status = tda1004x_read_byte(state, TDA1004X_STATUS_CD);
-        if (status == -1) {
+        if (status == -1)
                 return -EIO;
-        }
 
         // decode
         *fe_status = 0;
-        if (status & 4) *fe_status |= FE_HAS_SIGNAL;
-        if (status & 2) *fe_status |= FE_HAS_CARRIER;
-        if (status & 8) *fe_status |= FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK;
+        if (status & 4)
+                *fe_status |= FE_HAS_SIGNAL;
+        if (status & 2)
+                *fe_status |= FE_HAS_CARRIER;
+        if (status & 8)
+                *fe_status |= FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK;
 
         // if we don't already have VITERBI (i.e. not LOCKED), see if the viterbi
         // is getting anything valid
         if (!(*fe_status & FE_HAS_VITERBI)) {
                 // read the CBER
                 cber = tda1004x_read_byte(state, TDA1004X_CBER_LSB);
-                if (cber == -1) return -EIO;
+                if (cber == -1)
+                        return -EIO;
                 status = tda1004x_read_byte(state, TDA1004X_CBER_MSB);
-                if (status == -1) return -EIO;
+                if (status == -1)
+                        return -EIO;
                 cber |= (status << 8);
                 tda1004x_read_byte(state, TDA1004X_CBER_RESET);
 
-                if (cber != 65535) {
+                if (cber != 65535)
                         *fe_status |= FE_HAS_VITERBI;
-                }
         }
 
         // if we DO have some valid VITERBI output, but don't already have SYNC
@@ -911,20 +949,22 @@ static int tda1004x_read_status(struct dvb_frontend* fe, fe_status_t * fe_status
         if ((*fe_status & FE_HAS_VITERBI) && (!(*fe_status & FE_HAS_SYNC))) {
                 // read the VBER
                 vber = tda1004x_read_byte(state, TDA1004X_VBER_LSB);
-                if (vber == -1) return -EIO;
+                if (vber == -1)
+                        return -EIO;
                 status = tda1004x_read_byte(state, TDA1004X_VBER_MID);
-                if (status == -1) return -EIO;
+                if (status == -1)
+                        return -EIO;
                 vber |= (status << 8);
                 status = tda1004x_read_byte(state, TDA1004X_VBER_MSB);
-                if (status == -1) return -EIO;
+                if (status == -1)
+                        return -EIO;
                 vber |= ((status << 16) & 0x0f);
                 tda1004x_read_byte(state, TDA1004X_CVBER_LUT);
 
                 // if RS has passed some valid TS packets, then we must be
                 // getting some SYNC bytes
-                if (vber < 16632) {
+                if (vber < 16632)
                         *fe_status |= FE_HAS_SYNC;
-                }
         }
 
         // success
@@ -941,7 +981,7 @@ static int tda1004x_read_signal_strength(struct dvb_frontend* fe, u16 * signal)
         dprintk("%s\n", __FUNCTION__);
 
         // determine the register to use
-        switch(state->demod_type) {
+        switch (state->demod_type) {
         case TDA1004X_DEMOD_TDA10045:
                 reg = TDA10045H_S_AGC;
                 break;
@@ -972,9 +1012,8 @@ static int tda1004x_read_snr(struct dvb_frontend* fe, u16 * snr)
         tmp = tda1004x_read_byte(state, TDA1004X_SNR);
         if (tmp < 0)
                 return -EIO;
-        if (tmp) {
+        if (tmp)
                 tmp = 255 - tmp;
-        }
 
         *snr = ((tmp << 8) | tmp);
         dprintk("%s: snr=0x%x\n", __FUNCTION__, *snr);
@@ -1009,11 +1048,11 @@ static int tda1004x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
                         break;
         }
 
-        if (tmp != 0x7f) {
+        if (tmp != 0x7f)
                 *ucblocks = tmp;
-        } else {
+        else
                 *ucblocks = 0xffffffff;
-        }
+
         dprintk("%s: ucblocks=0x%x\n", __FUNCTION__, *ucblocks);
         return 0;
 }
@@ -1027,10 +1066,12 @@ static int tda1004x_read_ber(struct dvb_frontend* fe, u32* ber)
 
         // read it in
         tmp = tda1004x_read_byte(state, TDA1004X_CBER_LSB);
-        if (tmp < 0) return -EIO;
+        if (tmp < 0)
+                return -EIO;
         *ber = tmp << 1;
         tmp = tda1004x_read_byte(state, TDA1004X_CBER_MSB);
-        if (tmp < 0) return -EIO;
+        if (tmp < 0)
+                return -EIO;
         *ber |= (tmp << 9);
         tda1004x_read_byte(state, TDA1004X_CBER_RESET);
 
@@ -1042,7 +1083,7 @@ static int tda1004x_sleep(struct dvb_frontend* fe)
 {
         struct tda1004x_state* state = fe->demodulator_priv;
 
-        switch(state->demod_type) {
+        switch (state->demod_type) {
         case TDA1004X_DEMOD_TDA10045:
                 tda1004x_write_mask(state, TDA1004X_CONFADC1, 0x10, 0x10);
                 break;
@@ -1066,74 +1107,11 @@ static int tda1004x_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronte
 
 static void tda1004x_release(struct dvb_frontend* fe)
 {
-        struct tda1004x_state* state = (struct tda1004x_state*) fe->demodulator_priv;
-        kfree(state);
-}
-
-static struct dvb_frontend_ops tda10045_ops;
-
-struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
-                                     struct i2c_adapter* i2c)
-{
-        struct tda1004x_state* state = NULL;
-
-        /* allocate memory for the internal state */
-        state = (struct tda1004x_state*) kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
-        if (state == NULL) goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        memcpy(&state->ops, &tda10045_ops, sizeof(struct dvb_frontend_ops));
-        state->initialised = 0;
-        state->demod_type = TDA1004X_DEMOD_TDA10045;
-
-        /* check if the demod is there */
-        if (tda1004x_read_byte(state, TDA1004X_CHIPID) != 0x25) goto error;
-
-        /* create dvb_frontend */
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
+        struct tda1004x_state *state = fe->demodulator_priv;
         kfree(state);
-        return NULL;
-}
-
-static struct dvb_frontend_ops tda10046_ops;
-
-struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
-                                     struct i2c_adapter* i2c)
-{
-        struct tda1004x_state* state = NULL;
-
-        /* allocate memory for the internal state */
-        state = (struct tda1004x_state*) kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
-        if (state == NULL) goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        memcpy(&state->ops, &tda10046_ops, sizeof(struct dvb_frontend_ops));
-        state->initialised = 0;
-        state->demod_type = TDA1004X_DEMOD_TDA10046;
-
-        /* check if the demod is there */
-        if (tda1004x_read_byte(state, TDA1004X_CHIPID) != 0x46) goto error;
-
-        /* create dvb_frontend */
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
-        if (state) kfree(state);
-        return NULL;
 }
 
 static struct dvb_frontend_ops tda10045_ops = {
-
         .info = {
                 .name = "Philips TDA10045H DVB-T",
                 .type = FE_OFDM,
@@ -1163,8 +1141,36 @@ static struct dvb_frontend_ops tda10045_ops = {
         .read_ucblocks = tda1004x_read_ucblocks,
 };
 
-static struct dvb_frontend_ops tda10046_ops = {
+struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
+                                     struct i2c_adapter* i2c)
+{
+        struct tda1004x_state *state;
+
+        /* allocate memory for the internal state */
+        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        if (!state)
+                return NULL;
+
+        /* setup the state */
+        state->config = config;
+        state->i2c = i2c;
+        memcpy(&state->ops, &tda10045_ops, sizeof(struct dvb_frontend_ops));
+        state->initialised = 0;
+        state->demod_type = TDA1004X_DEMOD_TDA10045;
+
+        /* check if the demod is there */
+        if (tda1004x_read_byte(state, TDA1004X_CHIPID) != 0x25) {
+                kfree(state);
+                return NULL;
+        }
 
+        /* create dvb_frontend */
+        state->frontend.ops = &state->ops;
+        state->frontend.demodulator_priv = state;
+        return &state->frontend;
+}
+
+static struct dvb_frontend_ops tda10046_ops = {
         .info = {
                 .name = "Philips TDA10046H DVB-T",
                 .type = FE_OFDM,
@@ -1194,6 +1200,36 @@ static struct dvb_frontend_ops tda10046_ops = {
         .read_ucblocks = tda1004x_read_ucblocks,
 };
 
+struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
+                                     struct i2c_adapter* i2c)
+{
+        struct tda1004x_state *state;
+
+        /* allocate memory for the internal state */
+        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        if (!state)
+                return NULL;
+
+        /* setup the state */
+        state->config = config;
+        state->i2c = i2c;
+        memcpy(&state->ops, &tda10046_ops, sizeof(struct dvb_frontend_ops));
+        state->initialised = 0;
+        state->demod_type = TDA1004X_DEMOD_TDA10046;
+        state->fw_version = 0x20;       /* dummy default value */
+
+        /* check if the demod is there */
+        if (tda1004x_read_byte(state, TDA1004X_CHIPID) != 0x46) {
+                kfree(state);
+                return NULL;
+        }
+
+        /* create dvb_frontend */
+        state->frontend.ops = &state->ops;
+        state->frontend.demodulator_priv = state;
+        return &state->frontend;
+}
+
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
 
diff --git a/drivers/media/dvb/frontends/tda1004x.h b/drivers/media/dvb/frontends/tda1004x.h
index e452fc0bad11..c8e1d54ff262 100644
--- a/drivers/media/dvb/frontends/tda1004x.h
+++ b/drivers/media/dvb/frontends/tda1004x.h
@@ -32,10 +32,13 @@ struct tda1004x_config
         u8 demod_address;
 
         /* does the "inversion" need inverted? */
-        u8 invert:1;
+        u8 invert;
 
         /* Does the OCLK signal need inverted? */
-        u8 invert_oclk:1;
+        u8 invert_oclk;
+
+        /* value of N_I2C of the CONF_PLL3 register */
+        u8 n_i2c;
 
         /* PLL maintenance */
         int (*pll_init)(struct dvb_frontend* fe);
diff --git a/drivers/media/dvb/frontends/tda8083.c b/drivers/media/dvb/frontends/tda8083.c
index da82e90d6d13..168e013d23bd 100644
--- a/drivers/media/dvb/frontends/tda8083.c
+++ b/drivers/media/dvb/frontends/tda8083.c
@@ -226,7 +226,7 @@ static int tda8083_send_diseqc_burst (struct tda8083_state* state, fe_sec_mini_c
 static int tda8083_send_diseqc_msg (struct dvb_frontend* fe,
                                     struct dvb_diseqc_master_cmd *m)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
         int i;
 
         tda8083_writereg (state, 0x29, (m->msg_len - 3) | (1 << 2)); /* enable */
@@ -243,7 +243,7 @@ static int tda8083_send_diseqc_msg (struct dvb_frontend* fe,
 
 static int tda8083_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         u8 signal = ~tda8083_readreg (state, 0x01);
         u8 sync = tda8083_readreg (state, 0x02);
@@ -270,7 +270,7 @@ static int tda8083_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int tda8083_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         u8 signal = ~tda8083_readreg (state, 0x01);
         *strength = (signal << 8) | signal;
@@ -280,7 +280,7 @@ static int tda8083_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int tda8083_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         u8 _snr = tda8083_readreg (state, 0x08);
         *snr = (_snr << 8) | _snr;
@@ -290,7 +290,7 @@ static int tda8083_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int tda8083_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         state->config->pll_set(fe, p);
         tda8083_set_inversion (state, p->inversion);
@@ -305,7 +305,7 @@ static int tda8083_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int tda8083_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         /*  FIXME: get symbolrate & frequency offset...*/
         /*p->frequency = ???;*/
@@ -319,7 +319,7 @@ static int tda8083_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int tda8083_sleep(struct dvb_frontend* fe)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         tda8083_writereg (state, 0x00, 0x02);
         return 0;
@@ -327,7 +327,7 @@ static int tda8083_sleep(struct dvb_frontend* fe)
 
 static int tda8083_init(struct dvb_frontend* fe)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
         int i;
 
         for (i=0; i<44; i++)
@@ -343,7 +343,7 @@ static int tda8083_init(struct dvb_frontend* fe)
 
 static int tda8083_diseqc_send_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t burst)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         tda8083_send_diseqc_burst (state, burst);
         tda8083_writereg (state, 0x00, 0x3c);
@@ -354,7 +354,7 @@ static int tda8083_diseqc_send_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t
 
 static int tda8083_diseqc_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         tda8083_set_tone (state, tone);
         tda8083_writereg (state, 0x00, 0x3c);
@@ -365,7 +365,7 @@ static int tda8083_diseqc_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t t
 
 static int tda8083_diseqc_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t voltage)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
 
         tda8083_set_voltage (state, voltage);
         tda8083_writereg (state, 0x00, 0x3c);
@@ -376,7 +376,7 @@ static int tda8083_diseqc_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t
 
 static void tda8083_release(struct dvb_frontend* fe)
 {
-        struct tda8083_state* state = (struct tda8083_state*) fe->demodulator_priv;
+        struct tda8083_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -388,7 +388,7 @@ struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
         struct tda8083_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct tda8083_state*) kmalloc(sizeof(struct tda8083_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct tda8083_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda80xx.c b/drivers/media/dvb/frontends/tda80xx.c
index c99632114283..032d348dafb7 100644
--- a/drivers/media/dvb/frontends/tda80xx.c
+++ b/drivers/media/dvb/frontends/tda80xx.c
@@ -27,7 +27,7 @@
 #include <linux/spinlock.h>
 #include <linux/threads.h>
 #include <linux/interrupt.h>
-#include <asm/irq.h>
+#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -400,7 +400,7 @@ static void tda80xx_wait_diseqc_fifo(struct tda80xx_state* state)
 
 static int tda8044_init(struct dvb_frontend* fe)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
         int ret;
 
         /*
@@ -432,7 +432,7 @@ static int tda8044_init(struct dvb_frontend* fe)
 
 static int tda8083_init(struct dvb_frontend* fe)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         tda80xx_write(state, 0x00, tda8083_inittab, sizeof(tda8083_inittab));
 
@@ -447,7 +447,7 @@ static int tda8083_init(struct dvb_frontend* fe)
 
 static int tda80xx_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t voltage)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         switch (voltage) {
         case SEC_VOLTAGE_13:
@@ -463,7 +463,7 @@ static int tda80xx_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t voltage
 
 static int tda80xx_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         switch (tone) {
         case SEC_TONE_OFF:
@@ -477,7 +477,7 @@ static int tda80xx_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
 
 static int tda80xx_send_diseqc_msg(struct dvb_frontend* fe, struct dvb_diseqc_master_cmd *cmd)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         if (cmd->msg_len > 6)
                 return -EINVAL;
@@ -492,7 +492,7 @@ static int tda80xx_send_diseqc_msg(struct dvb_frontend* fe, struct dvb_diseqc_ma
 
 static int tda80xx_send_diseqc_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t cmd)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         switch (cmd) {
         case SEC_MINI_A:
@@ -512,7 +512,7 @@ static int tda80xx_send_diseqc_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t
 
 static int tda80xx_sleep(struct dvb_frontend* fe)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         tda80xx_writereg(state, 0x00, 0x02);    /* enter standby */
 
@@ -521,7 +521,7 @@ static int tda80xx_sleep(struct dvb_frontend* fe)
 
 static int tda80xx_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         tda80xx_writereg(state, 0x1c, 0x80);
         state->config->pll_set(fe, p);
@@ -537,7 +537,7 @@ static int tda80xx_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int tda80xx_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         if (!state->config->irq)
                 tda80xx_read_status_int(state);
@@ -550,7 +550,7 @@ static int tda80xx_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int tda80xx_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         if (!state->config->irq)
                 tda80xx_read_status_int(state);
@@ -561,7 +561,7 @@ static int tda80xx_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int tda80xx_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
         int ret;
         u8 buf[3];
 
@@ -575,7 +575,7 @@ static int tda80xx_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int tda80xx_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         u8 gain = ~tda80xx_readreg(state, 0x01);
         *strength = (gain << 8) | gain;
@@ -585,7 +585,7 @@ static int tda80xx_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int tda80xx_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         u8 quality = tda80xx_readreg(state, 0x08);
         *snr = (quality << 8) | quality;
@@ -595,7 +595,7 @@ static int tda80xx_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int tda80xx_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         *ucblocks = tda80xx_readreg(state, 0x0f);
         if (*ucblocks == 0xff)
@@ -606,7 +606,7 @@ static int tda80xx_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int tda80xx_init(struct dvb_frontend* fe)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         switch(state->id) {
         case ID_TDA8044:
@@ -620,7 +620,7 @@ static int tda80xx_init(struct dvb_frontend* fe)
 
 static void tda80xx_release(struct dvb_frontend* fe)
 {
-        struct tda80xx_state* state = (struct tda80xx_state*) fe->demodulator_priv;
+        struct tda80xx_state* state = fe->demodulator_priv;
 
         if (state->config->irq)
                 free_irq(state->config->irq, &state->worklet);
@@ -637,7 +637,7 @@ struct dvb_frontend* tda80xx_attach(const struct tda80xx_config* config,
         int ret;
 
         /* allocate memory for the internal state */
-        state = (struct tda80xx_state*) kmalloc(sizeof(struct tda80xx_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct tda80xx_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/ves1820.c b/drivers/media/dvb/frontends/ves1820.c
index 9c0d23e1d9e5..70fb44b391a7 100644
--- a/drivers/media/dvb/frontends/ves1820.c
+++ b/drivers/media/dvb/frontends/ves1820.c
@@ -70,7 +70,6 @@ static int ves1820_writereg(struct ves1820_state *state, u8 reg, u8 data)
                 printk("ves1820: %s(): writereg error (reg == 0x%02x,"
                         "val == 0x%02x, ret == %i)\n", __FUNCTION__, reg, data, ret);
 
-        msleep(10);
         return (ret != 1) ? -EREMOTEIO : 0;
 }
 
@@ -193,7 +192,7 @@ static int ves1820_set_symbolrate(struct ves1820_state *state, u32 symbolrate)
 
 static int ves1820_init(struct dvb_frontend* fe)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
         int i;
         int val;
 
@@ -214,7 +213,7 @@ static int ves1820_init(struct dvb_frontend* fe)
 
 static int ves1820_set_parameters(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
         static const u8 reg0x00[] = { 0x00, 0x04, 0x08, 0x0c, 0x10 };
         static const u8 reg0x01[] = { 140, 140, 106, 100, 92 };
         static const u8 reg0x05[] = { 135, 100, 70, 54, 38 };
@@ -241,7 +240,7 @@ static int ves1820_set_parameters(struct dvb_frontend* fe, struct dvb_frontend_p
 
 static int ves1820_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
         int sync;
 
         *status = 0;
@@ -267,7 +266,7 @@ static int ves1820_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int ves1820_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
 
         u32 _ber = ves1820_readreg(state, 0x14) |
                         (ves1820_readreg(state, 0x15) << 8) |
@@ -279,7 +278,7 @@ static int ves1820_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int ves1820_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
 
         u8 gain = ves1820_readreg(state, 0x17);
         *strength = (gain << 8) | gain;
@@ -289,7 +288,7 @@ static int ves1820_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int ves1820_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
 
         u8 quality = ~ves1820_readreg(state, 0x18);
         *snr = (quality << 8) | quality;
@@ -299,7 +298,7 @@ static int ves1820_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int ves1820_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
 
         *ucblocks = ves1820_readreg(state, 0x13) & 0x7f;
         if (*ucblocks == 0x7f)
@@ -314,7 +313,7 @@ static int ves1820_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int ves1820_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
         int sync;
         s8 afc = 0;
 
@@ -345,7 +344,7 @@ static int ves1820_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int ves1820_sleep(struct dvb_frontend* fe)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
 
         ves1820_writereg(state, 0x1b, 0x02);    /* pdown ADC */
         ves1820_writereg(state, 0x00, 0x80);    /* standby */
@@ -364,7 +363,7 @@ static int ves1820_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronten
 
 static void ves1820_release(struct dvb_frontend* fe)
 {
-        struct ves1820_state* state = (struct ves1820_state*) fe->demodulator_priv;
+        struct ves1820_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -377,7 +376,7 @@ struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
         struct ves1820_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = (struct ves1820_state*) kmalloc(sizeof(struct ves1820_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct ves1820_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/ves1x93.c b/drivers/media/dvb/frontends/ves1x93.c
index edcad283aa86..821df8e839d0 100644
--- a/drivers/media/dvb/frontends/ves1x93.c
+++ b/drivers/media/dvb/frontends/ves1x93.c
@@ -263,7 +263,7 @@ static int ves1x93_set_symbolrate (struct ves1x93_state* state, u32 srate)
 
 static int ves1x93_init (struct dvb_frontend* fe)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
         int i;
         int val;
 
@@ -289,7 +289,7 @@ static int ves1x93_init (struct dvb_frontend* fe)
 
 static int ves1x93_set_voltage (struct dvb_frontend* fe, fe_sec_voltage_t voltage)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         switch (voltage) {
         case SEC_VOLTAGE_13:
@@ -305,7 +305,7 @@ static int ves1x93_set_voltage (struct dvb_frontend* fe, fe_sec_voltage_t voltag
 
 static int ves1x93_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         u8 sync = ves1x93_readreg (state, 0x0e);
 
@@ -346,7 +346,7 @@ static int ves1x93_read_status(struct dvb_frontend* fe, fe_status_t* status)
 
 static int ves1x93_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         *ber = ves1x93_readreg (state, 0x15);
         *ber |= (ves1x93_readreg (state, 0x16) << 8);
@@ -358,7 +358,7 @@ static int ves1x93_read_ber(struct dvb_frontend* fe, u32* ber)
 
 static int ves1x93_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         u8 signal = ~ves1x93_readreg (state, 0x0b);
         *strength = (signal << 8) | signal;
@@ -368,7 +368,7 @@ static int ves1x93_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 
 static int ves1x93_read_snr(struct dvb_frontend* fe, u16* snr)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         u8 _snr = ~ves1x93_readreg (state, 0x1c);
         *snr = (_snr << 8) | _snr;
@@ -378,7 +378,7 @@ static int ves1x93_read_snr(struct dvb_frontend* fe, u16* snr)
 
 static int ves1x93_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         *ucblocks = ves1x93_readreg (state, 0x18) & 0x7f;
 
@@ -393,7 +393,7 @@ static int ves1x93_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 
 static int ves1x93_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         ves1x93_writereg(state, 0x00, 0x11);
         state->config->pll_set(fe, p);
@@ -408,7 +408,7 @@ static int ves1x93_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int ves1x93_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
         int afc;
 
         afc = ((int)((char)(ves1x93_readreg (state, 0x0a) << 1)))/2;
@@ -431,14 +431,14 @@ static int ves1x93_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_par
 
 static int ves1x93_sleep(struct dvb_frontend* fe)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
 
         return ves1x93_writereg (state, 0x00, 0x08);
 }
 
 static void ves1x93_release(struct dvb_frontend* fe)
 {
-        struct ves1x93_state* state = (struct ves1x93_state*) fe->demodulator_priv;
+        struct ves1x93_state* state = fe->demodulator_priv;
         kfree(state);
 }
 
@@ -451,7 +451,7 @@ struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
         u8 identity;
 
         /* allocate memory for the internal state */
-        state = (struct ves1x93_state*) kmalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
+        state = kmalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 922c205a2652..8e33a850e13e 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -130,7 +130,7 @@ static void init_av7110_av(struct av7110 *av7110)
         av7110->current_input = 0;
         if (i2c_writereg(av7110, 0x20, 0x00, 0x00) == 1) {
                 printk ("dvb-ttpci: Crystal audio DAC @ card %d detected\n",
-                        av7110->dvb_adapter->num);
+                        av7110->dvb_adapter.num);
                 av7110->adac_type = DVB_ADAC_CRYSTAL;
                 i2c_writereg(av7110, 0x20, 0x01, 0xd2);
                 i2c_writereg(av7110, 0x20, 0x02, 0x49);
@@ -145,13 +145,13 @@ static void init_av7110_av(struct av7110 *av7110)
         }
         else if (dev->pci->subsystem_vendor == 0x110a) {
                 printk("dvb-ttpci: DVB-C w/o analog module @ card %d detected\n",
-                        av7110->dvb_adapter->num);
+                        av7110->dvb_adapter.num);
                 av7110->adac_type = DVB_ADAC_NONE;
         }
         else {
                 av7110->adac_type = adac;
                 printk("dvb-ttpci: adac type set to %d @ card %d\n",
-                        av7110->dvb_adapter->num, av7110->adac_type);
+                        av7110->dvb_adapter.num, av7110->adac_type);
         }
 
         if (av7110->adac_type == DVB_ADAC_NONE || av7110->adac_type == DVB_ADAC_MSP) {
@@ -231,7 +231,7 @@ static int arm_thread(void *data)
 
                 if (newloops == av7110->arm_loops) {
                         printk(KERN_ERR "dvb-ttpci: ARM crashed @ card %d\n",
-                               av7110->dvb_adapter->num);
+                               av7110->dvb_adapter.num);
 
                         arm_error(av7110);
                         av7710_set_video_mode(av7110, vidmode);
@@ -1282,7 +1282,7 @@ static int av7110_register(struct av7110 *av7110)
         av7110->dmxdev.demux = &dvbdemux->dmx;
         av7110->dmxdev.capabilities = 0;
 
-        dvb_dmxdev_init(&av7110->dmxdev, av7110->dvb_adapter);
+        dvb_dmxdev_init(&av7110->dmxdev, &av7110->dvb_adapter);
 
         av7110->hw_frontend.source = DMX_FRONTEND_0;
 
@@ -1307,11 +1307,11 @@ static int av7110_register(struct av7110 *av7110)
         av7110_ca_register(av7110);
 
 #ifdef CONFIG_DVB_AV7110_OSD
-        dvb_register_device(av7110->dvb_adapter, &av7110->osd_dev,
+        dvb_register_device(&av7110->dvb_adapter, &av7110->osd_dev,
                             &dvbdev_osd, av7110, DVB_DEVICE_OSD);
 #endif
 
-        dvb_net_init(av7110->dvb_adapter, &av7110->dvb_net, &dvbdemux->dmx);
+        dvb_net_init(&av7110->dvb_adapter, &av7110->dvb_net, &dvbdemux->dmx);
 
         if (budgetpatch) {
                 /* initialize software demux1 without its own frontend
@@ -1334,9 +1334,9 @@ static int av7110_register(struct av7110 *av7110)
                 av7110->dmxdev1.demux = &dvbdemux1->dmx;
                 av7110->dmxdev1.capabilities = 0;
 
-                dvb_dmxdev_init(&av7110->dmxdev1, av7110->dvb_adapter);
+                dvb_dmxdev_init(&av7110->dmxdev1, &av7110->dvb_adapter);
 
-                dvb_net_init(av7110->dvb_adapter, &av7110->dvb_net1, &dvbdemux1->dmx);
+                dvb_net_init(&av7110->dvb_adapter, &av7110->dvb_net1, &dvbdemux1->dmx);
                 printk("dvb-ttpci: additional demux1 for budget-patch registered\n");
         }
         return 0;
@@ -1673,6 +1673,106 @@ static struct stv0299_config alps_bsru6_config = {
 };
 
 
+static u8 alps_bsbe1_inittab[] = {
+        0x01, 0x15,
+        0x02, 0x30,
+        0x03, 0x00,
+        0x04, 0x7d,   /* F22FR = 0x7d, F22 = f_VCO / 128 / 0x7d = 22 kHz */
+        0x05, 0x35,   /* I2CT = 0, SCLT = 1, SDAT = 1 */
+        0x06, 0x40,   /* DAC not used, set to high impendance mode */
+        0x07, 0x00,   /* DAC LSB */
+        0x08, 0x40,   /* DiSEqC off, LNB power on OP2/LOCK pin on */
+        0x09, 0x00,   /* FIFO */
+        0x0c, 0x51,   /* OP1 ctl = Normal, OP1 val = 1 (LNB Power ON) */
+        0x0d, 0x82,   /* DC offset compensation = ON, beta_agc1 = 2 */
+        0x0e, 0x23,   /* alpha_tmg = 2, beta_tmg = 3 */
+        0x10, 0x3f,   // AGC2  0x3d
+        0x11, 0x84,
+        0x12, 0xb5,   // Lock detect: -64  Carrier freq detect:on
+        0x15, 0xc9,   // lock detector threshold
+        0x16, 0x00,
+        0x17, 0x00,
+        0x18, 0x00,
+        0x19, 0x00,
+        0x1a, 0x00,
+        0x1f, 0x50,
+        0x20, 0x00,
+        0x21, 0x00,
+        0x22, 0x00,
+        0x23, 0x00,
+        0x28, 0x00,  // out imp: normal  out type: parallel FEC mode:0
+        0x29, 0x1e,  // 1/2 threshold
+        0x2a, 0x14,  // 2/3 threshold
+        0x2b, 0x0f,  // 3/4 threshold
+        0x2c, 0x09,  // 5/6 threshold
+        0x2d, 0x05,  // 7/8 threshold
+        0x2e, 0x01,
+        0x31, 0x1f,  // test all FECs
+        0x32, 0x19,  // viterbi and synchro search
+        0x33, 0xfc,  // rs control
+        0x34, 0x93,  // error control
+        0x0f, 0x92,
+        0xff, 0xff
+};
+
+static int alps_bsbe1_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
+{
+        struct av7110* av7110 = (struct av7110*) fe->dvb->priv;
+        int ret;
+        u8 data[4];
+        u32 div;
+        struct i2c_msg msg = { .addr = 0x61, .flags = 0, .buf = data, .len = sizeof(data) };
+
+        if ((params->frequency < 950000) || (params->frequency > 2150000))
+                return -EINVAL;
+
+        div = (params->frequency + (125 - 1)) / 125; // round correctly
+        data[0] = (div >> 8) & 0x7f;
+        data[1] = div & 0xff;
+        data[2] = 0x80 | ((div & 0x18000) >> 10) | 4;
+        data[3] = (params->frequency > 1530000) ? 0xE0 : 0xE4;
+
+        ret = i2c_transfer(&av7110->i2c_adap, &msg, 1);
+        return (ret != 1) ? -EIO : 0;
+}
+
+static struct stv0299_config alps_bsbe1_config = {
+        .demod_address = 0x68,
+        .inittab = alps_bsbe1_inittab,
+        .mclk = 88000000UL,
+        .invert = 1,
+        .enhanced_tuning = 0,
+        .skip_reinit = 0,
+        .min_delay_ms = 100,
+        .set_symbol_rate = alps_bsru6_set_symbol_rate,
+        .pll_set = alps_bsbe1_pll_set,
+};
+
+static int lnbp21_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t voltage)
+{
+        struct av7110* av7110 = (struct av7110*) fe->dvb->priv;
+        int ret;
+        u8 data[1];
+        struct i2c_msg msg = { .addr = 0x08, .flags = 0, .buf = data, .len = sizeof(data) };
+
+        switch(voltage) {
+        case SEC_VOLTAGE_OFF:
+                data[0] = 0x00;
+                break;
+        case SEC_VOLTAGE_13:
+                data[0] = 0x44;
+                break;
+        case SEC_VOLTAGE_18:
+                data[0] = 0x4c;
+                break;
+        default:
+                return -EINVAL;
+        };
+
+        ret = i2c_transfer(&av7110->i2c_adap, &msg, 1);
+        return (ret != 1) ? -EIO : 0;
+}
+
 
 static int alps_tdbe2_pll_set(struct dvb_frontend* fe, struct dvb_frontend_parameters* params)
 {
@@ -2116,6 +2216,14 @@ static int frontend_init(struct av7110 *av7110)
                                 av7110->dev->i2c_bitrate = SAA7146_I2C_BUS_BIT_RATE_240;
                                 break;
                         }
+                        break;
+
+                case 0x000E: /* Hauppauge/TT Nexus-S rev 2.3 */
+                        /* ALPS BSBE1 */
+                        av7110->fe = stv0299_attach(&alps_bsbe1_config, &av7110->i2c_adap);
+                        if (av7110->fe)
+                                av7110->fe->ops->set_voltage = lnbp21_set_voltage;
+                        break;
                 }
         }
 
@@ -2138,7 +2246,7 @@ static int frontend_init(struct av7110 *av7110)
                 FE_FUNC_OVERRIDE(av7110->fe->ops->dishnetwork_send_legacy_command, av7110->fe_dishnetwork_send_legacy_command, av7110_fe_dishnetwork_send_legacy_command);
                 FE_FUNC_OVERRIDE(av7110->fe->ops->set_frontend, av7110->fe_set_frontend, av7110_fe_set_frontend);
 
-                ret = dvb_register_frontend(av7110->dvb_adapter, av7110->fe);
+                ret = dvb_register_frontend(&av7110->dvb_adapter, av7110->fe);
                 if (ret < 0) {
                         printk("av7110: Frontend registration failed!\n");
                         if (av7110->fe->ops->release)
@@ -2352,7 +2460,7 @@ static int av7110_attach(struct saa7146_dev* dev, struct saa7146_pci_extension_d
                 goto err_dvb_unregister_adapter_2;
 
         ttpci_eeprom_parse_mac(&av7110->i2c_adap,
-                               av7110->dvb_adapter->proposed_mac);
+                               av7110->dvb_adapter.proposed_mac);
         ret = -ENOMEM;
 
         if (budgetpatch) {
@@ -2523,7 +2631,7 @@ static int av7110_attach(struct saa7146_dev* dev, struct saa7146_pci_extension_d
         if (ret < 0)
                 goto err_av7110_unregister_11;
 
-        av7110->dvb_adapter->priv = av7110;
+        av7110->dvb_adapter.priv = av7110;
         ret = frontend_init(av7110);
         if (ret < 0)
                 goto err_av7110_exit_v4l_12;
@@ -2558,7 +2666,7 @@ err_saa71466_vfree_4:
 err_i2c_del_3:
         i2c_del_adapter(&av7110->i2c_adap);
 err_dvb_unregister_adapter_2:
-        dvb_unregister_adapter(av7110->dvb_adapter);
+        dvb_unregister_adapter(&av7110->dvb_adapter);
 err_put_firmware_1:
         put_firmware(av7110);
 err_kfree_0:
@@ -2604,7 +2712,7 @@ static int av7110_detach(struct saa7146_dev* saa)
 
         i2c_del_adapter(&av7110->i2c_adap);
 
-        dvb_unregister_adapter (av7110->dvb_adapter);
+        dvb_unregister_adapter (&av7110->dvb_adapter);
 
         av7110_num--;
 
@@ -2672,21 +2780,23 @@ MAKE_AV7110_INFO(ttt_1_X,    "Technotrend/Hauppauge WinTV DVB-T rev1.X");
 MAKE_AV7110_INFO(ttc_1_X,    "Technotrend/Hauppauge WinTV Nexus-CA rev1.X");
 MAKE_AV7110_INFO(ttc_2_X,    "Technotrend/Hauppauge WinTV DVB-C rev2.X");
 MAKE_AV7110_INFO(tts_2_X,    "Technotrend/Hauppauge WinTV Nexus-S rev2.X");
+MAKE_AV7110_INFO(tts_2_3,    "Technotrend/Hauppauge WinTV Nexus-S rev2.3");
 MAKE_AV7110_INFO(tts_1_3se,  "Technotrend/Hauppauge WinTV DVB-S rev1.3 SE");
 MAKE_AV7110_INFO(ttt,        "Technotrend/Hauppauge DVB-T");
 MAKE_AV7110_INFO(fsc,        "Fujitsu Siemens DVB-C");
 MAKE_AV7110_INFO(fss,        "Fujitsu Siemens DVB-S rev1.6");
 
 static struct pci_device_id pci_tbl[] = {
+        MAKE_EXTENSION_PCI(fsc,       0x110a, 0x0000),
         MAKE_EXTENSION_PCI(tts_1_X,   0x13c2, 0x0000),
         MAKE_EXTENSION_PCI(ttt_1_X,   0x13c2, 0x0001),
         MAKE_EXTENSION_PCI(ttc_2_X,   0x13c2, 0x0002),
         MAKE_EXTENSION_PCI(tts_2_X,   0x13c2, 0x0003),
-        MAKE_EXTENSION_PCI(tts_1_3se, 0x13c2, 0x1002),
-        MAKE_EXTENSION_PCI(fsc,       0x110a, 0x0000),
-        MAKE_EXTENSION_PCI(ttc_1_X,   0x13c2, 0x000a),
         MAKE_EXTENSION_PCI(fss,       0x13c2, 0x0006),
         MAKE_EXTENSION_PCI(ttt,       0x13c2, 0x0008),
+        MAKE_EXTENSION_PCI(ttc_1_X,   0x13c2, 0x000a),
+        MAKE_EXTENSION_PCI(tts_2_3,   0x13c2, 0x000e),
+        MAKE_EXTENSION_PCI(tts_1_3se, 0x13c2, 0x1002),
 
 /*      MAKE_EXTENSION_PCI(???, 0x13c2, 0x0004), UNDEFINED CARD */ // Galaxis DVB PC-Sat-Carte
 /*      MAKE_EXTENSION_PCI(???, 0x13c2, 0x0005), UNDEFINED CARD */ // Technisat SkyStar1
diff --git a/drivers/media/dvb/ttpci/av7110.h b/drivers/media/dvb/ttpci/av7110.h
index 5070e0523da7..4f69b4d01479 100644
--- a/drivers/media/dvb/ttpci/av7110.h
+++ b/drivers/media/dvb/ttpci/av7110.h
@@ -220,7 +220,7 @@ struct av7110 {
 
         struct audio_mixer      mixer;
 
-        struct dvb_adapter       *dvb_adapter;
+        struct dvb_adapter       dvb_adapter;
         struct dvb_device        *video_dev;
         struct dvb_device        *audio_dev;
         struct dvb_device        *ca_dev;
@@ -274,7 +274,6 @@ extern void av7110_ir_exit (void);
 extern int i2c_writereg(struct av7110 *av7110, u8 id, u8 reg, u8 val);
 extern u8 i2c_readreg(struct av7110 *av7110, u8 id, u8 reg);
 extern int msp_writereg(struct av7110 *av7110, u8 dev, u16 reg, u16 val);
-extern int msp_readreg(struct av7110 *av7110, u8 dev, u16 reg, u16 *val);
 
 
 extern int av7110_init_analog_module(struct av7110 *av7110);
diff --git a/drivers/media/dvb/ttpci/av7110_av.c b/drivers/media/dvb/ttpci/av7110_av.c
index d77e8a00688f..ccf946125d02 100644
--- a/drivers/media/dvb/ttpci/av7110_av.c
+++ b/drivers/media/dvb/ttpci/av7110_av.c
@@ -1075,7 +1075,7 @@ static int dvb_video_ioctl(struct inode *inode, struct file *file,
                 }
                 if (ret < 0)
                         break;
-                av7110->videostate.video_format = format;
+                av7110->videostate.display_format = format;
                 ret = av7110_fw_cmd(av7110, COMTYPE_ENCODER, SetPanScanType,
                                     1, (u16) val);
                 break;
@@ -1230,14 +1230,20 @@ static int dvb_audio_ioctl(struct inode *inode, struct file *file,
                 switch(av7110->audiostate.channel_select) {
                 case AUDIO_STEREO:
                         audcom(av7110, AUDIO_CMD_STEREO);
+                        if (av7110->adac_type == DVB_ADAC_CRYSTAL)
+                                i2c_writereg(av7110, 0x20, 0x02, 0x49);
                         break;
 
                 case AUDIO_MONO_LEFT:
                         audcom(av7110, AUDIO_CMD_MONO_L);
+                        if (av7110->adac_type == DVB_ADAC_CRYSTAL)
+                                i2c_writereg(av7110, 0x20, 0x02, 0x4a);
                         break;
 
                 case AUDIO_MONO_RIGHT:
                         audcom(av7110, AUDIO_CMD_MONO_R);
+                        if (av7110->adac_type == DVB_ADAC_CRYSTAL)
+                                i2c_writereg(av7110, 0x20, 0x02, 0x45);
                         break;
 
                 default:
@@ -1409,10 +1415,10 @@ int av7110_av_register(struct av7110 *av7110)
         av7110->video_events.overflow = 0;
         memset(&av7110->video_size, 0, sizeof (video_size_t));
 
-        dvb_register_device(av7110->dvb_adapter, &av7110->video_dev,
+        dvb_register_device(&av7110->dvb_adapter, &av7110->video_dev,
                             &dvbdev_video, av7110, DVB_DEVICE_VIDEO);
 
-        dvb_register_device(av7110->dvb_adapter, &av7110->audio_dev,
+        dvb_register_device(&av7110->dvb_adapter, &av7110->audio_dev,
                             &dvbdev_audio, av7110, DVB_DEVICE_AUDIO);
 
         return 0;
diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c
index 21f7aacf7726..c3801e328fe9 100644
--- a/drivers/media/dvb/ttpci/av7110_ca.c
+++ b/drivers/media/dvb/ttpci/av7110_ca.c
@@ -123,7 +123,7 @@ static void ci_ll_release(struct dvb_ringbuffer *cirbuf, struct dvb_ringbuffer *
 }
 
 static int ci_ll_reset(struct dvb_ringbuffer *cibuf, struct file *file,
-                int slots, ca_slot_info_t *slot)
+                       int slots, ca_slot_info_t *slot)
 {
         int i;
         int len = 0;
@@ -370,7 +370,7 @@ static struct dvb_device dvbdev_ca = {
 
 int av7110_ca_register(struct av7110 *av7110)
 {
-        return dvb_register_device(av7110->dvb_adapter, &av7110->ca_dev,
+        return dvb_register_device(&av7110->dvb_adapter, &av7110->ca_dev,
                                    &dvbdev_ca, av7110, DVB_DEVICE_CA);
 }
 
diff --git a/drivers/media/dvb/ttpci/av7110_hw.c b/drivers/media/dvb/ttpci/av7110_hw.c
index bd6e5ea4aefe..7fa4a0ebe133 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.c
+++ b/drivers/media/dvb/ttpci/av7110_hw.c
@@ -104,7 +104,7 @@ u32 av7110_debiread(struct av7110 *av7110, u32 config, int addr, int count)
 
 
 /* av7110 ARM core boot stuff */
-
+#if 0
 void av7110_reset_arm(struct av7110 *av7110)
 {
         saa7146_setgpio(av7110->dev, RESET_LINE, SAA7146_GPIO_OUTLO);
@@ -124,7 +124,7 @@ void av7110_reset_arm(struct av7110 *av7110)
         av7110->arm_ready = 1;
         dprintk(1, "reset ARM\n");
 }
-
+#endif  /*  0  */
 
 static int waitdebi(struct av7110 *av7110, int adr, int state)
 {
@@ -335,7 +335,7 @@ int av7110_wait_msgstate(struct av7110 *av7110, u16 flags)
         return 0;
 }
 
-int __av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
+static int __av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
 {
         int i;
         unsigned long start;
@@ -455,7 +455,7 @@ int __av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
         return 0;
 }
 
-int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
+static int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
 {
         int ret;
 
@@ -500,6 +500,7 @@ int av7110_fw_cmd(struct av7110 *av7110, int type, int com, int num, ...)
         return ret;
 }
 
+#if 0
 int av7110_send_ci_cmd(struct av7110 *av7110, u8 subcom, u8 *buf, u8 len)
 {
         int i, ret;
@@ -521,6 +522,7 @@ int av7110_send_ci_cmd(struct av7110 *av7110, u8 subcom, u8 *buf, u8 len)
                 printk(KERN_ERR "dvb-ttpci: av7110_send_ci_cmd error %d\n", ret);
         return ret;
 }
+#endif  /*  0  */
 
 int av7110_fw_request(struct av7110 *av7110, u16 *request_buf,
                       int request_buf_len, u16 *reply_buf, int reply_buf_len)
@@ -593,7 +595,7 @@ int av7110_fw_request(struct av7110 *av7110, u16 *request_buf,
         return 0;
 }
 
-int av7110_fw_query(struct av7110 *av7110, u16 tag, u16* buf, s16 length)
+static int av7110_fw_query(struct av7110 *av7110, u16 tag, u16* buf, s16 length)
 {
         int ret;
         ret = av7110_fw_request(av7110, &tag, 0, buf, length);
@@ -617,7 +619,7 @@ int av7110_firmversion(struct av7110 *av7110)
 
         if (av7110_fw_query(av7110, tag, buf, 16)) {
                 printk("dvb-ttpci: failed to boot firmware @ card %d\n",
-                       av7110->dvb_adapter->num);
+                       av7110->dvb_adapter.num);
                 return -EIO;
         }
 
@@ -628,16 +630,16 @@ int av7110_firmversion(struct av7110 *av7110)
         av7110->avtype = (buf[8] << 16) + buf[9];
 
         printk("dvb-ttpci: info @ card %d: firm %08x, rtsl %08x, vid %08x, app %08x\n",
-               av7110->dvb_adapter->num, av7110->arm_fw,
+               av7110->dvb_adapter.num, av7110->arm_fw,
                av7110->arm_rtsl, av7110->arm_vid, av7110->arm_app);
 
         /* print firmware capabilities */
         if (FW_CI_LL_SUPPORT(av7110->arm_app))
                 printk("dvb-ttpci: firmware @ card %d supports CI link layer interface\n",
-                       av7110->dvb_adapter->num);
+                       av7110->dvb_adapter.num);
         else
                 printk("dvb-ttpci: no firmware support for CI link layer interface @ card %d\n",
-                       av7110->dvb_adapter->num);
+                       av7110->dvb_adapter.num);
 
         return 0;
 }
diff --git a/drivers/media/dvb/ttpci/av7110_hw.h b/drivers/media/dvb/ttpci/av7110_hw.h
index bf901c624682..52061e17c6dd 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.h
+++ b/drivers/media/dvb/ttpci/av7110_hw.h
@@ -364,7 +364,6 @@ enum av7110_command_type {
 
 
 
-extern void av7110_reset_arm(struct av7110 *av7110);
 extern int av7110_bootarm(struct av7110 *av7110);
 extern int av7110_firmversion(struct av7110 *av7110);
 #define FW_CI_LL_SUPPORT(arm_app) ((arm_app) & 0x80000000)
@@ -373,12 +372,8 @@ extern int av7110_firmversion(struct av7110 *av7110);
 
 extern int av7110_wait_msgstate(struct av7110 *av7110, u16 flags);
 extern int av7110_fw_cmd(struct av7110 *av7110, int type, int com, int num, ...);
-extern int __av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length);
-extern int av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length);
-extern int av7110_send_ci_cmd(struct av7110 *av7110, u8 subcom, u8 *buf, u8 len);
 extern int av7110_fw_request(struct av7110 *av7110, u16 *request_buf,
                              int request_buf_len, u16 *reply_buf, int reply_buf_len);
-extern int av7110_fw_query(struct av7110 *av7110, u16 tag, u16* Buff, s16 length);
 
 
 /* DEBI (saa7146 data extension bus interface) access */
diff --git a/drivers/media/dvb/ttpci/av7110_ir.c b/drivers/media/dvb/ttpci/av7110_ir.c
index 6d2256f1e354..665cdb8a3f71 100644
--- a/drivers/media/dvb/ttpci/av7110_ir.c
+++ b/drivers/media/dvb/ttpci/av7110_ir.c
@@ -10,7 +10,7 @@
 
 #define UP_TIMEOUT (HZ/4)
 
-/* enable ir debugging by or'ing av7110_debug with 16 */
+/* enable ir debugging by or'ing debug with 16 */
 
 static int ir_initialized;
 static struct input_dev input_dev;
diff --git a/drivers/media/dvb/ttpci/av7110_v4l.c b/drivers/media/dvb/ttpci/av7110_v4l.c
index eb84fb08d95c..e65fc36e2ce8 100644
--- a/drivers/media/dvb/ttpci/av7110_v4l.c
+++ b/drivers/media/dvb/ttpci/av7110_v4l.c
@@ -46,13 +46,13 @@ int msp_writereg(struct av7110 *av7110, u8 dev, u16 reg, u16 val)
 
         if (i2c_transfer(&av7110->i2c_adap, &msgs, 1) != 1) {
                 dprintk(1, "dvb-ttpci: failed @ card %d, %u = %u\n",
-                       av7110->dvb_adapter->num, reg, val);
+                       av7110->dvb_adapter.num, reg, val);
                 return -EIO;
         }
         return 0;
 }
 
-int msp_readreg(struct av7110 *av7110, u8 dev, u16 reg, u16 *val)
+static int msp_readreg(struct av7110 *av7110, u8 dev, u16 reg, u16 *val)
 {
         u8 msg1[3] = { dev, reg >> 8, reg & 0xff };
         u8 msg2[2];
@@ -63,7 +63,7 @@ int msp_readreg(struct av7110 *av7110, u8 dev, u16 reg, u16 *val)
 
         if (i2c_transfer(&av7110->i2c_adap, &msgs[0], 2) != 2) {
                 dprintk(1, "dvb-ttpci: failed @ card %d, %u\n",
-                       av7110->dvb_adapter->num, reg);
+                       av7110->dvb_adapter.num, reg);
                 return -EIO;
         }
         *val = (msg2[0] << 8) | msg2[1];
@@ -552,13 +552,13 @@ int av7110_init_analog_module(struct av7110 *av7110)
                 return -ENODEV;
 
         printk("dvb-ttpci: DVB-C analog module @ card %d detected, initializing MSP3400\n",
-                av7110->dvb_adapter->num);
+                av7110->dvb_adapter.num);
         av7110->adac_type = DVB_ADAC_MSP;
         msleep(100); // the probing above resets the msp...
         msp_readreg(av7110, MSP_RD_DSP, 0x001e, &version1);
         msp_readreg(av7110, MSP_RD_DSP, 0x001f, &version2);
         dprintk(1, "dvb-ttpci: @ card %d MSP3400 version 0x%04x 0x%04x\n",
-                av7110->dvb_adapter->num, version1, version2);
+                av7110->dvb_adapter.num, version1, version2);
         msp_writereg(av7110, MSP_WR_DSP, 0x0013, 0x0c00);
         msp_writereg(av7110, MSP_WR_DSP, 0x0000, 0x7f00); // loudspeaker + headphone
         msp_writereg(av7110, MSP_WR_DSP, 0x0008, 0x0220); // loudspeaker source
@@ -596,7 +596,7 @@ int av7110_init_analog_module(struct av7110 *av7110)
                 /* init the saa7113 */
                 while (*i != 0xff) {
                         if (i2c_writereg(av7110, 0x48, i[0], i[1]) != 1) {
-                                dprintk(1, "saa7113 initialization failed @ card %d", av7110->dvb_adapter->num);
+                                dprintk(1, "saa7113 initialization failed @ card %d", av7110->dvb_adapter.num);
                                 break;
                         }
                         i += 2;
@@ -726,11 +726,11 @@ static int std_callback(struct saa7146_dev* dev, struct saa7146_standard *std)
 {
         struct av7110 *av7110 = (struct av7110*) dev->ext_priv;
 
-        if (std->id == V4L2_STD_PAL) {
+        if (std->id & V4L2_STD_PAL) {
                 av7110->vidmode = VIDEO_MODE_PAL;
                 av7110_set_vidmode(av7110, av7110->vidmode);
         }
-        else if (std->id == V4L2_STD_NTSC) {
+        else if (std->id & V4L2_STD_NTSC) {
                 av7110->vidmode = VIDEO_MODE_NTSC;
                 av7110_set_vidmode(av7110, av7110->vidmode);
         }
diff --git a/drivers/media/dvb/ttpci/budget-av.c b/drivers/media/dvb/ttpci/budget-av.c
index 14e963206b89..6e0f5d307c52 100644
--- a/drivers/media/dvb/ttpci/budget-av.c
+++ b/drivers/media/dvb/ttpci/budget-av.c
@@ -59,8 +59,12 @@ struct budget_av {
         struct dvb_ca_en50221 ca;
 };
 
-static int enable_ci = 0;
-
+/* GPIO CI Connections:
+ * 0 - Vcc/Reset (Reset is controlled by capacitor)
+ * 1 - Attribute Memory
+ * 2 - Card Enable (Active Low)
+ * 3 - Card Detect
+ */
 
 /****************************************************************************
  * INITIALIZATION
@@ -188,22 +192,35 @@ static int ciintf_slot_reset(struct dvb_ca_en50221 *ca, int slot)
 {
         struct budget_av *budget_av = (struct budget_av *) ca->data;
         struct saa7146_dev *saa = budget_av->budget.dev;
-        int max = 20;
+        int timeout = 50; // 5 seconds (4.4.6 Ready)
 
         if (slot != 0)
                 return -EINVAL;
 
         dprintk(1, "ciintf_slot_reset\n");
 
-        /* reset the card */
-        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTHI);
-        msleep(100);
-        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTLO);
+        saa7146_setgpio(saa, 2, SAA7146_GPIO_OUTHI); /* disable card */
 
-        while (--max > 0 && ciintf_read_attribute_mem(ca, slot, 0) != 0x1d)
+        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTHI); /* Vcc off */
+        msleep(2);
+        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTLO); /* Vcc on */
+        msleep(20); /* 20 ms Vcc settling time */
+
+        saa7146_setgpio(saa, 2, SAA7146_GPIO_OUTLO); /* enable card */
+
+        /* This should have been based on pin 16 READY of the pcmcia port,
+         * but AFAICS it is not routed to the saa7146 */
+        while (--timeout > 0 && ciintf_read_attribute_mem(ca, slot, 0) != 0x1d)
                 msleep(100);
 
-        ttpci_budget_set_video_port(saa, BUDGET_VIDEO_PORTB);
+        if (timeout <= 0)
+        {
+                printk(KERN_ERR "budget-av: cam reset failed (timeout).\n");
+                saa7146_setgpio(saa, 2, SAA7146_GPIO_OUTHI); /* disable card */
+                saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTHI); /* Vcc off */
+                return -ETIMEDOUT;
+        }
+
         return 0;
 }
 
@@ -240,7 +257,6 @@ static int ciintf_poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open
 {
         struct budget_av *budget_av = (struct budget_av *) ca->data;
         struct saa7146_dev *saa = budget_av->budget.dev;
-        int cam = 0;
 
         if (slot != 0)
                 return -EINVAL;
@@ -248,15 +264,21 @@ static int ciintf_poll_slot_status(struct dvb_ca_en50221 *ca, int slot, int open
         if (!budget_av->slot_status) {
                 saa7146_setgpio(saa, 3, SAA7146_GPIO_INPUT);
                 udelay(1);
-                cam = saa7146_read(saa, PSR) & MASK_06;
-                saa7146_setgpio(saa, 3, SAA7146_GPIO_OUTLO);
-
-                if (cam)
+                if (saa7146_read(saa, PSR) & MASK_06)
+                {
+                        printk(KERN_INFO "budget-av: cam inserted\n");
                         budget_av->slot_status = 1;
+                }
+                saa7146_setgpio(saa, 3, SAA7146_GPIO_OUTLO);
         } else if (!open) {
                 saa7146_setgpio(budget_av->budget.dev, 1, SAA7146_GPIO_OUTLO);
                 if (ttpci_budget_debiread(&budget_av->budget, DEBICICAM, 0, 1, 0, 1) == -ETIMEDOUT)
+                {
+                        printk(KERN_INFO "budget-av: cam ejected\n");
+                        saa7146_setgpio(saa, 2, SAA7146_GPIO_OUTHI); /* disable card */
+                        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTHI); /* Vcc off */
                         budget_av->slot_status = 0;
+                }
         }
 
         if (budget_av->slot_status == 1)
@@ -272,17 +294,11 @@ static int ciintf_init(struct budget_av *budget_av)
 
         memset(&budget_av->ca, 0, sizeof(struct dvb_ca_en50221));
 
-        /* setup GPIOs */
-        saa7146_setgpio(saa, 1, SAA7146_GPIO_OUTHI);
+        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTLO);
+        saa7146_setgpio(saa, 1, SAA7146_GPIO_OUTLO);
         saa7146_setgpio(saa, 2, SAA7146_GPIO_OUTLO);
         saa7146_setgpio(saa, 3, SAA7146_GPIO_OUTLO);
 
-        /* Reset the card */
-        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTHI);
-        msleep(50);
-        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTLO);
-        msleep(100);
-
         /* Enable DEBI pins */
         saa7146_write(saa, MC1, saa7146_read(saa, MC1) | (0x800 << 16) | 0x800);
 
@@ -297,13 +313,14 @@ static int ciintf_init(struct budget_av *budget_av)
         budget_av->ca.slot_ts_enable = ciintf_slot_ts_enable;
         budget_av->ca.poll_slot_status = ciintf_poll_slot_status;
         budget_av->ca.data = budget_av;
-        if ((result = dvb_ca_en50221_init(budget_av->budget.dvb_adapter,
+
+        if ((result = dvb_ca_en50221_init(&budget_av->budget.dvb_adapter,
                                           &budget_av->ca, 0, 1)) != 0) {
-                printk("budget_av: CI interface detected, but initialisation failed.\n");
+                printk(KERN_ERR "budget-av: ci initialisation failed.\n");
                 goto error;
         }
-        // success!
-        printk("ciintf_init: CI interface initialised\n");
+
+        printk(KERN_INFO "budget-av: ci interface initialised.\n");
         budget_av->budget.ci_present = 1;
         return 0;
 
@@ -361,8 +378,12 @@ static const u8 saa7113_tab[] = {
 static int saa7113_init(struct budget_av *budget_av)
 {
         struct budget *budget = &budget_av->budget;
+        struct saa7146_dev *saa = budget->dev;
         const u8 *data = saa7113_tab;
 
+        saa7146_setgpio(saa, 0, SAA7146_GPIO_OUTHI);
+        msleep(200);
+
         if (i2c_writereg(&budget->i2c_adap, 0x4a, 0x01, 0x08) != 1) {
                 dprintk(1, "saa7113 not found on KNC card\n");
                 return -ENODEV;
@@ -697,75 +718,90 @@ static u8 read_pwm(struct budget_av *budget_av)
         return pwm;
 }
 
+#define SUBID_DVBS_KNC1         0x0010
+#define SUBID_DVBS_KNC1_PLUS    0x0011
+#define SUBID_DVBS_TYPHOON      0x4f56
+#define SUBID_DVBS_CINERGY1200  0x1154
+
+#define SUBID_DVBC_KNC1         0x0020
+#define SUBID_DVBC_KNC1_PLUS    0x0021
+#define SUBID_DVBC_CINERGY1200  0x1156
+
+#define SUBID_DVBT_KNC1_PLUS    0x0031
+#define SUBID_DVBT_KNC1         0x0030
+#define SUBID_DVBT_CINERGY1200  0x1157
 
 static void frontend_init(struct budget_av *budget_av)
 {
-        switch (budget_av->budget.dev->pci->subsystem_device) {
-        case 0x4f56:            // Typhoon/KNC1 DVB-S budget (stv0299/Philips SU1278(tsa5059))
-                budget_av->budget.dvb_frontend =
-                        stv0299_attach(&typhoon_config, &budget_av->budget.i2c_adap);
-                if (budget_av->budget.dvb_frontend != NULL) {
+        struct saa7146_dev * saa = budget_av->budget.dev;
+        struct dvb_frontend * fe = NULL;
+
+        switch (saa->pci->subsystem_device) {
+                case SUBID_DVBS_KNC1_PLUS:
+                case SUBID_DVBC_KNC1_PLUS:
+                case SUBID_DVBT_KNC1_PLUS:
+                        // Enable / PowerON Frontend
+                        saa7146_setgpio(saa, 3, SAA7146_GPIO_OUTHI);
                         break;
-                }
+        }
+
+        switch (saa->pci->subsystem_device) {
+
+        case SUBID_DVBS_KNC1:
+        case SUBID_DVBS_KNC1_PLUS:
+        case SUBID_DVBS_TYPHOON:
+                fe = stv0299_attach(&typhoon_config,
+                                    &budget_av->budget.i2c_adap);
                 break;
 
-        case 0x0020:            // KNC1 DVB-C budget (tda10021/Philips CU1216(tua6034))
-                budget_av->budget.dvb_frontend =
-                        tda10021_attach(&philips_cu1216_config,
-                                        &budget_av->budget.i2c_adap, read_pwm(budget_av));
-                if (budget_av->budget.dvb_frontend != NULL) {
-                        break;
-                }
+        case SUBID_DVBS_CINERGY1200:
+                fe = stv0299_attach(&cinergy_1200s_config,
+                                    &budget_av->budget.i2c_adap);
                 break;
 
-        case 0x0030:            // KNC1 DVB-T budget (tda10046/Philips TU1216(tda6651tt))
-                budget_av->budget.dvb_frontend =
-                        tda10046_attach(&philips_tu1216_config, &budget_av->budget.i2c_adap);
-                if (budget_av->budget.dvb_frontend != NULL) {
-                        break;
-                }
+        case SUBID_DVBC_KNC1:
+        case SUBID_DVBC_KNC1_PLUS:
+                fe = tda10021_attach(&philips_cu1216_config,
+                                     &budget_av->budget.i2c_adap,
+                                     read_pwm(budget_av));
                 break;
 
-        case 0x1154:            // TerraTec Cinergy 1200 DVB-S (stv0299/Philips SU1278(tsa5059))
-                budget_av->budget.dvb_frontend =
-                        stv0299_attach(&cinergy_1200s_config, &budget_av->budget.i2c_adap);
-                if (budget_av->budget.dvb_frontend != NULL) {
-                        break;
-                }
+        case SUBID_DVBT_KNC1:
+        case SUBID_DVBT_KNC1_PLUS:
+                fe = tda10046_attach(&philips_tu1216_config,
+                                     &budget_av->budget.i2c_adap);
                 break;
 
-        case 0x1156:            // Terratec Cinergy 1200 DVB-C (tda10021/Philips CU1216(tua6034))
-                budget_av->budget.dvb_frontend =
-                        tda10021_attach(&philips_cu1216_config,
-                                        &budget_av->budget.i2c_adap, read_pwm(budget_av));
-                if (budget_av->budget.dvb_frontend) {
-                        break;
-                }
+        case SUBID_DVBC_CINERGY1200:
+                fe = tda10021_attach(&philips_cu1216_config,
+                                     &budget_av->budget.i2c_adap,
+                                     read_pwm(budget_av));
                 break;
 
-        case 0x1157:            // Terratec Cinergy 1200 DVB-T (tda10046/Philips TU1216(tda6651tt))
-                budget_av->budget.dvb_frontend =
-                        tda10046_attach(&philips_tu1216_config, &budget_av->budget.i2c_adap);
-                if (budget_av->budget.dvb_frontend) {
-                        break;
-                }
+        case SUBID_DVBT_CINERGY1200:
+                fe = tda10046_attach(&philips_tu1216_config,
+                                     &budget_av->budget.i2c_adap);
                 break;
         }
 
-        if (budget_av->budget.dvb_frontend == NULL) {
-                printk("budget_av: A frontend driver was not found for device %04x/%04x subsystem %04x/%04x\n",
-                       budget_av->budget.dev->pci->vendor,
-                       budget_av->budget.dev->pci->device,
-                       budget_av->budget.dev->pci->subsystem_vendor,
-                       budget_av->budget.dev->pci->subsystem_device);
-        } else {
-                if (dvb_register_frontend
-                    (budget_av->budget.dvb_adapter, budget_av->budget.dvb_frontend)) {
-                        printk("budget-av: Frontend registration failed!\n");
-                        if (budget_av->budget.dvb_frontend->ops->release)
-                                budget_av->budget.dvb_frontend->ops->release(budget_av->budget.dvb_frontend);
-                        budget_av->budget.dvb_frontend = NULL;
-                }
+        if (fe == NULL) {
+                printk(KERN_ERR "budget-av: A frontend driver was not found "
+                                "for device %04x/%04x subsystem %04x/%04x\n",
+                       saa->pci->vendor,
+                       saa->pci->device,
+                       saa->pci->subsystem_vendor,
+                       saa->pci->subsystem_device);
+                return;
+        }
+
+        budget_av->budget.dvb_frontend = fe;
+
+        if (dvb_register_frontend(&budget_av->budget.dvb_adapter,
+                                  budget_av->budget.dvb_frontend)) {
+                printk(KERN_ERR "budget-av: Frontend registration failed!\n");
+                if (budget_av->budget.dvb_frontend->ops->release)
+                        budget_av->budget.dvb_frontend->ops->release(budget_av->budget.dvb_frontend);
+                budget_av->budget.dvb_frontend = NULL;
         }
 }
 
@@ -822,6 +858,7 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
 
         memset(budget_av, 0, sizeof(struct budget_av));
 
+        budget_av->has_saa7113 = 0;
         budget_av->budget.ci_present = 0;
 
         dev->ext_priv = budget_av;
@@ -836,10 +873,7 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
         saa7146_write(dev, DD1_INIT, 0x07000600);
         saa7146_write(dev, MC2, MASK_09 | MASK_25 | MASK_10 | MASK_26);
 
-        saa7146_setgpio(dev, 0, SAA7146_GPIO_OUTHI);
-        msleep(500);
-
-        if (0 == saa7113_init(budget_av)) {
+        if (saa7113_init(budget_av) == 0) {
                 budget_av->has_saa7113 = 1;
 
                 if (0 != saa7146_vv_init(dev, &vv_data)) {
@@ -860,31 +894,26 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
 
                 saa7113_setinput(budget_av, 0);
         } else {
-                budget_av->has_saa7113 = 0;
-
-                saa7146_setgpio(dev, 0, SAA7146_GPIO_OUTLO);
+                ciintf_init(budget_av);
         }
 
         /* fixme: find some sane values here... */
         saa7146_write(dev, PCI_BT_V1, 0x1c00101f);
 
-        mac = budget_av->budget.dvb_adapter->proposed_mac;
+        mac = budget_av->budget.dvb_adapter.proposed_mac;
         if (i2c_readregs(&budget_av->budget.i2c_adap, 0xa0, 0x30, mac, 6)) {
-                printk("KNC1-%d: Could not read MAC from KNC1 card\n",
-                       budget_av->budget.dvb_adapter->num);
+                printk(KERN_ERR "KNC1-%d: Could not read MAC from KNC1 card\n",
+                       budget_av->budget.dvb_adapter.num);
                 memset(mac, 0, 6);
         } else {
-                printk("KNC1-%d: MAC addr = %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
-                       budget_av->budget.dvb_adapter->num,
+                printk(KERN_INFO "KNC1-%d: MAC addr = %.2x:%.2x:%.2x:%.2x:%.2x:%.2x\n",
+                       budget_av->budget.dvb_adapter.num,
                        mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
         }
 
-        budget_av->budget.dvb_adapter->priv = budget_av;
+        budget_av->budget.dvb_adapter.priv = budget_av;
         frontend_init(budget_av);
 
-        if (enable_ci)
-                ciintf_init(budget_av);
-
         return 0;
 }
 
@@ -963,14 +992,21 @@ static struct saa7146_extension budget_extension;
 MAKE_BUDGET_INFO(knc1s, "KNC1 DVB-S", BUDGET_KNC1S);
 MAKE_BUDGET_INFO(knc1c, "KNC1 DVB-C", BUDGET_KNC1C);
 MAKE_BUDGET_INFO(knc1t, "KNC1 DVB-T", BUDGET_KNC1T);
+MAKE_BUDGET_INFO(knc1sp, "KNC1 DVB-S Plus", BUDGET_KNC1SP);
+MAKE_BUDGET_INFO(knc1cp, "KNC1 DVB-C Plus", BUDGET_KNC1CP);
+MAKE_BUDGET_INFO(knc1tp, "KNC1 DVB-T Plus", BUDGET_KNC1TP);
 MAKE_BUDGET_INFO(cin1200s, "TerraTec Cinergy 1200 DVB-S", BUDGET_CIN1200S);
 MAKE_BUDGET_INFO(cin1200c, "Terratec Cinergy 1200 DVB-C", BUDGET_CIN1200C);
 MAKE_BUDGET_INFO(cin1200t, "Terratec Cinergy 1200 DVB-T", BUDGET_CIN1200T);
 
 static struct pci_device_id pci_tbl[] = {
         MAKE_EXTENSION_PCI(knc1s, 0x1131, 0x4f56),
+        MAKE_EXTENSION_PCI(knc1s, 0x1131, 0x0010),
+        MAKE_EXTENSION_PCI(knc1sp, 0x1131, 0x0011),
         MAKE_EXTENSION_PCI(knc1c, 0x1894, 0x0020),
+        MAKE_EXTENSION_PCI(knc1cp, 0x1894, 0x0021),
         MAKE_EXTENSION_PCI(knc1t, 0x1894, 0x0030),
+        MAKE_EXTENSION_PCI(knc1tp, 0x1894, 0x0031),
         MAKE_EXTENSION_PCI(cin1200s, 0x153b, 0x1154),
         MAKE_EXTENSION_PCI(cin1200c, 0x153b, 0x1156),
         MAKE_EXTENSION_PCI(cin1200t, 0x153b, 0x1157),
@@ -1010,5 +1046,3 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Ralph Metzler, Marcus Metzler, Michael Hunold, others");
 MODULE_DESCRIPTION("driver for the SAA7146 based so-called "
                    "budget PCI DVB w/ analog input and CI-module (e.g. the KNC cards)");
-module_param_named(enable_ci, enable_ci, int, 0644);
-MODULE_PARM_DESC(enable_ci, "Turn on/off CI module (default:off).");
diff --git a/drivers/media/dvb/ttpci/budget-ci.c b/drivers/media/dvb/ttpci/budget-ci.c
index 521111be3558..dce116111376 100644
--- a/drivers/media/dvb/ttpci/budget-ci.c
+++ b/drivers/media/dvb/ttpci/budget-ci.c
@@ -395,7 +395,7 @@ static int ciintf_init(struct budget_ci *budget_ci)
         budget_ci->ca.slot_shutdown = ciintf_slot_shutdown;
         budget_ci->ca.slot_ts_enable = ciintf_slot_ts_enable;
         budget_ci->ca.data = budget_ci;
-        if ((result = dvb_ca_en50221_init(budget_ci->budget.dvb_adapter,
+        if ((result = dvb_ca_en50221_init(&budget_ci->budget.dvb_adapter,
                                           &budget_ci->ca,
                                           DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE |
                                           DVB_CA_EN50221_FLAG_IRQ_FR |
@@ -881,7 +881,7 @@ static void frontend_init(struct budget_ci *budget_ci)
                        budget_ci->budget.dev->pci->subsystem_device);
         } else {
                 if (dvb_register_frontend
-                    (budget_ci->budget.dvb_adapter, budget_ci->budget.dvb_frontend)) {
+                    (&budget_ci->budget.dvb_adapter, budget_ci->budget.dvb_frontend)) {
                         printk("budget-ci: Frontend registration failed!\n");
                         if (budget_ci->budget.dvb_frontend->ops->release)
                                 budget_ci->budget.dvb_frontend->ops->release(budget_ci->budget.dvb_frontend);
@@ -916,7 +916,7 @@ static int budget_ci_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
 
         ciintf_init(budget_ci);
 
-        budget_ci->budget.dvb_adapter->priv = budget_ci;
+        budget_ci->budget.dvb_adapter.priv = budget_ci;
         frontend_init(budget_ci);
 
         return 0;
diff --git a/drivers/media/dvb/ttpci/budget-core.c b/drivers/media/dvb/ttpci/budget-core.c
index 93a9b40917e4..0498a055a4cd 100644
--- a/drivers/media/dvb/ttpci/budget-core.c
+++ b/drivers/media/dvb/ttpci/budget-core.c
@@ -298,7 +298,7 @@ static int budget_register(struct budget *budget)
         budget->dmxdev.demux = &dvbdemux->dmx;
         budget->dmxdev.capabilities = 0;
 
-        dvb_dmxdev_init(&budget->dmxdev, budget->dvb_adapter);
+        dvb_dmxdev_init(&budget->dmxdev, &budget->dvb_adapter);
 
         budget->hw_frontend.source = DMX_FRONTEND_0;
 
@@ -316,7 +316,7 @@ static int budget_register(struct budget *budget)
         if (ret < 0)
                 return ret;
 
-        dvb_net_init(budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx);
+        dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx);
 
         return 0;
 }
@@ -385,11 +385,11 @@ int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
         strcpy(budget->i2c_adap.name, budget->card->name);
 
         if (i2c_add_adapter(&budget->i2c_adap) < 0) {
-                dvb_unregister_adapter(budget->dvb_adapter);
+                dvb_unregister_adapter(&budget->dvb_adapter);
                 return -ENOMEM;
         }
 
-        ttpci_eeprom_parse_mac(&budget->i2c_adap, budget->dvb_adapter->proposed_mac);
+        ttpci_eeprom_parse_mac(&budget->i2c_adap, budget->dvb_adapter.proposed_mac);
 
         if (NULL ==
             (budget->grabbing = saa7146_vmalloc_build_pgtable(dev->pci, length, &budget->pt))) {
@@ -417,7 +417,7 @@ err:
 
         vfree(budget->grabbing);
 
-        dvb_unregister_adapter(budget->dvb_adapter);
+        dvb_unregister_adapter(&budget->dvb_adapter);
 
         return ret;
 }
@@ -432,7 +432,7 @@ int ttpci_budget_deinit(struct budget *budget)
 
         i2c_del_adapter(&budget->i2c_adap);
 
-        dvb_unregister_adapter(budget->dvb_adapter);
+        dvb_unregister_adapter(&budget->dvb_adapter);
 
         tasklet_kill(&budget->vpe_tasklet);
 
diff --git a/drivers/media/dvb/ttpci/budget-patch.c b/drivers/media/dvb/ttpci/budget-patch.c
index 5d524a4f213f..8142e26b47f5 100644
--- a/drivers/media/dvb/ttpci/budget-patch.c
+++ b/drivers/media/dvb/ttpci/budget-patch.c
@@ -453,7 +453,7 @@ static void frontend_init(struct budget_patch* budget)
                        budget->dev->pci->subsystem_vendor,
                        budget->dev->pci->subsystem_device);
         } else {
-                if (dvb_register_frontend(budget->dvb_adapter, budget->dvb_frontend)) {
+                if (dvb_register_frontend(&budget->dvb_adapter, budget->dvb_frontend)) {
                         printk("budget-av: Frontend registration failed!\n");
                         if (budget->dvb_frontend->ops->release)
                                 budget->dvb_frontend->ops->release(budget->dvb_frontend);
@@ -702,7 +702,7 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
 
         dev->ext_priv = budget;
 
-        budget->dvb_adapter->priv = budget;
+        budget->dvb_adapter.priv = budget;
         frontend_init(budget);
 
         return 0;
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 5e6a10f4ad95..083fd44e5f90 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -468,7 +468,7 @@ static void frontend_init(struct budget *budget)
                        budget->dev->pci->subsystem_vendor,
                        budget->dev->pci->subsystem_device);
         } else {
-                if (dvb_register_frontend(budget->dvb_adapter, budget->dvb_frontend)) {
+                if (dvb_register_frontend(&budget->dvb_adapter, budget->dvb_frontend)) {
                         printk("budget: Frontend registration failed!\n");
                         if (budget->dvb_frontend->ops->release)
                                 budget->dvb_frontend->ops->release(budget->dvb_frontend);
@@ -497,7 +497,7 @@ static int budget_attach (struct saa7146_dev* dev, struct saa7146_pci_extension_
                 return err;
         }
 
-        budget->dvb_adapter->priv = budget;
+        budget->dvb_adapter.priv = budget;
         frontend_init(budget);
 
         return 0;
diff --git a/drivers/media/dvb/ttpci/budget.h b/drivers/media/dvb/ttpci/budget.h
index 10bd41f0363b..c6ef496ba70a 100644
--- a/drivers/media/dvb/ttpci/budget.h
+++ b/drivers/media/dvb/ttpci/budget.h
@@ -64,7 +64,7 @@ struct budget {
 
         spinlock_t debilock;
 
-        struct dvb_adapter *dvb_adapter;
+        struct dvb_adapter dvb_adapter;
         struct dvb_frontend *dvb_frontend;
         void *priv;
 };
@@ -92,6 +92,9 @@ static struct saa7146_pci_extension_data x_var = { \
 #define BUDGET_KNC1S               8
 #define BUDGET_KNC1C               9
 #define BUDGET_KNC1T               10
+#define BUDGET_KNC1SP              11
+#define BUDGET_KNC1CP              12
+#define BUDGET_KNC1TP              13
 
 #define BUDGET_VIDEO_PORTA         0
 #define BUDGET_VIDEO_PORTB         1
diff --git a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
index 4c046ece883a..afa0e7a0e506 100644
--- a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
@@ -84,7 +84,7 @@ struct ttusb {
         struct semaphore semi2c;
         struct semaphore semusb;
 
-        struct dvb_adapter *adapter;
+        struct dvb_adapter adapter;
         struct usb_device *dev;
 
         struct i2c_adapter i2c_adap;
@@ -1065,7 +1065,7 @@ static int alps_tdmb7_pll_set(struct dvb_frontend* fe, struct dvb_frontend_param
         return 0;
 }
 
-struct cx22700_config alps_tdmb7_config = {
+static struct cx22700_config alps_tdmb7_config = {
         .demod_address = 0x43,
         .pll_set = alps_tdmb7_pll_set,
 };
@@ -1412,7 +1412,7 @@ static void frontend_init(struct ttusb* ttusb)
                        le16_to_cpu(ttusb->dev->descriptor.idVendor),
                        le16_to_cpu(ttusb->dev->descriptor.idProduct));
         } else {
-                if (dvb_register_frontend(ttusb->adapter, ttusb->fe)) {
+                if (dvb_register_frontend(&ttusb->adapter, ttusb->fe)) {
                         printk("dvb-ttusb-budget: Frontend registration failed!\n");
                         if (ttusb->fe->ops->release)
                                 ttusb->fe->ops->release(ttusb->fe);
@@ -1462,7 +1462,7 @@ static int ttusb_probe(struct usb_interface *intf, const struct usb_device_id *i
         up(&ttusb->semi2c);
 
         dvb_register_adapter(&ttusb->adapter, "Technotrend/Hauppauge Nova-USB", THIS_MODULE);
-        ttusb->adapter->priv = ttusb;
+        ttusb->adapter.priv = ttusb;
 
         /* i2c */
         memset(&ttusb->i2c_adap, 0, sizeof(struct i2c_adapter));
@@ -1481,7 +1481,7 @@ static int ttusb_probe(struct usb_interface *intf, const struct usb_device_id *i
 
         result = i2c_add_adapter(&ttusb->i2c_adap);
         if (result) {
-                dvb_unregister_adapter (ttusb->adapter);
+                dvb_unregister_adapter (&ttusb->adapter);
                 return result;
         }
 
@@ -1503,7 +1503,7 @@ static int ttusb_probe(struct usb_interface *intf, const struct usb_device_id *i
         if ((result = dvb_dmx_init(&ttusb->dvb_demux)) < 0) {
                 printk("ttusb_dvb: dvb_dmx_init failed (errno = %d)\n", result);
                 i2c_del_adapter(&ttusb->i2c_adap);
-                dvb_unregister_adapter (ttusb->adapter);
+                dvb_unregister_adapter (&ttusb->adapter);
                 return -ENODEV;
         }
 //FIXME dmxdev (nur WAS?)
@@ -1511,21 +1511,21 @@ static int ttusb_probe(struct usb_interface *intf, const struct usb_device_id *i
         ttusb->dmxdev.demux = &ttusb->dvb_demux.dmx;
         ttusb->dmxdev.capabilities = 0;
 
-        if ((result = dvb_dmxdev_init(&ttusb->dmxdev, ttusb->adapter)) < 0) {
+        if ((result = dvb_dmxdev_init(&ttusb->dmxdev, &ttusb->adapter)) < 0) {
                 printk("ttusb_dvb: dvb_dmxdev_init failed (errno = %d)\n",
                        result);
                 dvb_dmx_release(&ttusb->dvb_demux);
                 i2c_del_adapter(&ttusb->i2c_adap);
-                dvb_unregister_adapter (ttusb->adapter);
+                dvb_unregister_adapter (&ttusb->adapter);
                 return -ENODEV;
         }
 
-        if (dvb_net_init(ttusb->adapter, &ttusb->dvbnet, &ttusb->dvb_demux.dmx)) {
+        if (dvb_net_init(&ttusb->adapter, &ttusb->dvbnet, &ttusb->dvb_demux.dmx)) {
                 printk("ttusb_dvb: dvb_net_init failed!\n");
                 dvb_dmxdev_release(&ttusb->dmxdev);
                 dvb_dmx_release(&ttusb->dvb_demux);
                 i2c_del_adapter(&ttusb->i2c_adap);
-                dvb_unregister_adapter (ttusb->adapter);
+                dvb_unregister_adapter (&ttusb->adapter);
                 return -ENODEV;
         }
 
@@ -1559,7 +1559,7 @@ static void ttusb_disconnect(struct usb_interface *intf)
         dvb_dmx_release(&ttusb->dvb_demux);
         if (ttusb->fe != NULL) dvb_unregister_frontend(ttusb->fe);
         i2c_del_adapter(&ttusb->i2c_adap);
-        dvb_unregister_adapter(ttusb->adapter);
+        dvb_unregister_adapter(&ttusb->adapter);
 
         ttusb_free_iso_urbs(ttusb);
 
diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index 64e771bd8907..505bdaff5a7e 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -98,7 +98,7 @@ struct ttusb_dec {
         int                             can_playback;
 
         /* DVB bits */
-        struct dvb_adapter              *adapter;
+        struct dvb_adapter              adapter;
         struct dmxdev                   dmxdev;
         struct dvb_demux                demux;
         struct dmx_frontend             frontend;
@@ -1435,7 +1435,7 @@ static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
                 printk("%s: dvb_dmx_init failed: error %d\n", __FUNCTION__,
                        result);
 
-                dvb_unregister_adapter(dec->adapter);
+                dvb_unregister_adapter(&dec->adapter);
 
                 return result;
         }
@@ -1444,12 +1444,12 @@ static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
         dec->dmxdev.demux = &dec->demux.dmx;
         dec->dmxdev.capabilities = 0;
 
-        if ((result = dvb_dmxdev_init(&dec->dmxdev, dec->adapter)) < 0) {
+        if ((result = dvb_dmxdev_init(&dec->dmxdev, &dec->adapter)) < 0) {
                 printk("%s: dvb_dmxdev_init failed: error %d\n",
                        __FUNCTION__, result);
 
                 dvb_dmx_release(&dec->demux);
-                dvb_unregister_adapter(dec->adapter);
+                dvb_unregister_adapter(&dec->adapter);
 
                 return result;
         }
@@ -1463,7 +1463,7 @@ static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
 
                 dvb_dmxdev_release(&dec->dmxdev);
                 dvb_dmx_release(&dec->demux);
-                dvb_unregister_adapter(dec->adapter);
+                dvb_unregister_adapter(&dec->adapter);
 
                 return result;
         }
@@ -1476,12 +1476,12 @@ static int ttusb_dec_init_dvb(struct ttusb_dec *dec)
                 dec->demux.dmx.remove_frontend(&dec->demux.dmx, &dec->frontend);
                 dvb_dmxdev_release(&dec->dmxdev);
                 dvb_dmx_release(&dec->demux);
-                dvb_unregister_adapter(dec->adapter);
+                dvb_unregister_adapter(&dec->adapter);
 
                 return result;
         }
 
-        dvb_net_init(dec->adapter, &dec->dvb_net, &dec->demux.dmx);
+        dvb_net_init(&dec->adapter, &dec->dvb_net, &dec->demux.dmx);
 
         return 0;
 }
@@ -1496,7 +1496,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
         dvb_dmxdev_release(&dec->dmxdev);
         dvb_dmx_release(&dec->demux);
         if (dec->fe) dvb_unregister_frontend(dec->fe);
-        dvb_unregister_adapter(dec->adapter);
+        dvb_unregister_adapter(&dec->adapter);
 }
 
 static void ttusb_dec_exit_rc(struct ttusb_dec *dec)
@@ -1565,15 +1565,15 @@ static void ttusb_dec_exit_filters(struct ttusb_dec *dec)
         }
 }
 
-int fe_send_command(struct dvb_frontend* fe, const u8 command,
-                    int param_length, const u8 params[],
-                    int *result_length, u8 cmd_result[])
+static int fe_send_command(struct dvb_frontend* fe, const u8 command,
+                           int param_length, const u8 params[],
+                           int *result_length, u8 cmd_result[])
 {
         struct ttusb_dec* dec = (struct ttusb_dec*) fe->dvb->priv;
         return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
 }
 
-struct ttusbdecfe_config fe_config = {
+static struct ttusbdecfe_config fe_config = {
         .send_command = fe_send_command
 };
 
@@ -1620,7 +1620,7 @@ static int ttusb_dec_probe(struct usb_interface *intf,
         }
         ttusb_dec_init_dvb(dec);
 
-        dec->adapter->priv = dec;
+        dec->adapter.priv = dec;
         switch (le16_to_cpu(id->idProduct)) {
         case 0x1006:
                 dec->fe = ttusbdecfe_dvbs_attach(&fe_config);
@@ -1637,7 +1637,7 @@ static int ttusb_dec_probe(struct usb_interface *intf,
                        le16_to_cpu(dec->udev->descriptor.idVendor),
                        le16_to_cpu(dec->udev->descriptor.idProduct));
         } else {
-                if (dvb_register_frontend(dec->adapter, dec->fe)) {
+                if (dvb_register_frontend(&dec->adapter, dec->fe)) {
                         printk("budget-ci: Frontend registration failed!\n");
                         if (dec->fe->ops->release)
                                 dec->fe->ops->release(dec->fe);
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index d3dd4228b72d..6c05fddb69ab 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -240,6 +240,7 @@ config VIDEO_SAA7134
         select VIDEO_BUF
         select VIDEO_IR
         select VIDEO_TUNER
+        select CRC32
         ---help---
           This is a video4linux driver for Philips SAA7130/7134 based
           TV cards.
diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
index 85224b90e394..6334122704ae 100644
--- a/drivers/media/video/bttv-cards.c
+++ b/drivers/media/video/bttv-cards.c
@@ -1946,7 +1946,6 @@ struct tvcard bttv_tvcards[] = {
         .no_tda9875     = 1,
         .no_tda7432     = 1,
         .tuner_type     = TUNER_ABSENT,
-        .no_video       = 1,
         .pll            = PLL_28,
 },{
         .name           = "Teppro TEV-560/InterVision IV-560",
diff --git a/drivers/media/video/bttv-i2c.c b/drivers/media/video/bttv-i2c.c
index e42f1ec13f3e..e3f477dff827 100644
--- a/drivers/media/video/bttv-i2c.c
+++ b/drivers/media/video/bttv-i2c.c
@@ -29,6 +29,7 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/delay.h>
+#include <linux/jiffies.h>
 #include <asm/io.h>
 
 #include "bttvp.h"
@@ -130,17 +131,14 @@ static u32 functionality(struct i2c_adapter *adap)
 static int
 bttv_i2c_wait_done(struct bttv *btv)
 {
-        DECLARE_WAITQUEUE(wait, current);
         int rc = 0;
 
-        add_wait_queue(&btv->i2c_queue, &wait);
-        if (0 == btv->i2c_done)
-                msleep_interruptible(20);
-        remove_wait_queue(&btv->i2c_queue, &wait);
+        /* timeout */
+        if (wait_event_interruptible_timeout(btv->i2c_queue,
+                btv->i2c_done, msecs_to_jiffies(85)) == -ERESTARTSYS)
+
+        rc = -EIO;
 
-        if (0 == btv->i2c_done)
-                /* timeout */
-                rc = -EIO;
         if (btv->i2c_done & BT848_INT_RACK)
                 rc = 1;
         btv->i2c_done = 0;
diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
index cee13584c9cf..fe6abe34168c 100644
--- a/drivers/media/video/saa7134/saa6752hs.c
+++ b/drivers/media/video/saa7134/saa6752hs.c
@@ -32,9 +32,32 @@ MODULE_LICENSE("GPL");
 static struct i2c_driver driver;
 static struct i2c_client client_template;
 
+enum saa6752hs_videoformat {
+        SAA6752HS_VF_D1 = 0,    /* standard D1 video format: 720x576 */
+        SAA6752HS_VF_2_3_D1 = 1,/* 2/3D1 video format: 480x576 */
+        SAA6752HS_VF_1_2_D1 = 2,/* 1/2D1 video format: 352x576 */
+        SAA6752HS_VF_SIF = 3,   /* SIF video format: 352x288 */
+        SAA6752HS_VF_UNKNOWN,
+};
+
+static const struct v4l2_format v4l2_format_table[] =
+{
+        [SAA6752HS_VF_D1] = {
+                .fmt.pix.width = 720, .fmt.pix.height = 576 },
+        [SAA6752HS_VF_2_3_D1] = {
+                .fmt.pix.width = 480, .fmt.pix.height = 576 },
+        [SAA6752HS_VF_1_2_D1] = {
+                .fmt.pix.width = 352, .fmt.pix.height = 576 },
+        [SAA6752HS_VF_SIF] = {
+                .fmt.pix.width = 352, .fmt.pix.height = 288 },
+        [SAA6752HS_VF_UNKNOWN] = {
+                .fmt.pix.width = 0, .fmt.pix.height = 0},
+};
+
 struct saa6752hs_state {
         struct i2c_client             client;
         struct v4l2_mpeg_compression  params;
+        enum saa6752hs_videoformat    video_format;
 };
 
 enum saa6752hs_command {
@@ -256,6 +279,51 @@ static int saa6752hs_set_bitrate(struct i2c_client* client,
         return 0;
 }
 
+static void saa6752hs_set_subsampling(struct i2c_client* client,
+                                      struct v4l2_format* f)
+{
+        struct saa6752hs_state *h = i2c_get_clientdata(client);
+        int dist_352, dist_480, dist_720;
+
+        /*
+          FIXME: translate and round width/height into EMPRESS
+          subsample type:
+
+          type   |   PAL   |  NTSC
+          ---------------------------
+          SIF    | 352x288 | 352x240
+          1/2 D1 | 352x576 | 352x480
+          2/3 D1 | 480x576 | 480x480
+          D1     | 720x576 | 720x480
+        */
+
+        dist_352 = abs(f->fmt.pix.width - 352);
+        dist_480 = abs(f->fmt.pix.width - 480);
+        dist_720 = abs(f->fmt.pix.width - 720);
+        if (dist_720 < dist_480) {
+                f->fmt.pix.width = 720;
+                f->fmt.pix.height = 576;
+                h->video_format = SAA6752HS_VF_D1;
+        }
+        else if (dist_480 < dist_352) {
+                f->fmt.pix.width = 480;
+                f->fmt.pix.height = 576;
+                h->video_format = SAA6752HS_VF_2_3_D1;
+        }
+        else {
+                f->fmt.pix.width = 352;
+                if (abs(f->fmt.pix.height - 576) <
+                    abs(f->fmt.pix.height - 288)) {
+                        f->fmt.pix.height = 576;
+                        h->video_format = SAA6752HS_VF_1_2_D1;
+                }
+                else {
+                        f->fmt.pix.height = 288;
+                        h->video_format = SAA6752HS_VF_SIF;
+                }
+        }
+}
+
 
 static void saa6752hs_set_params(struct i2c_client* client,
                                  struct v4l2_mpeg_compression* params)
@@ -315,7 +383,7 @@ static int saa6752hs_init(struct i2c_client* client)
 
         // Set video format - must be done first as it resets other settings
         buf[0] = 0x41;
-        buf[1] = 0 /* MPEG_VIDEO_FORMAT_D1 */;
+        buf[1] = h->video_format;
         i2c_master_send(client, buf, 2);
 
         // set bitrate
@@ -494,6 +562,25 @@ saa6752hs_command(struct i2c_client *client, unsigned int cmd, void *arg)
         case VIDIOC_G_MPEGCOMP:
                 *params = h->params;
                 break;
+        case VIDIOC_G_FMT:
+        {
+           struct v4l2_format *f = arg;
+
+           if (h->video_format == SAA6752HS_VF_UNKNOWN)
+                   h->video_format = SAA6752HS_VF_D1;
+           f->fmt.pix.width =
+                   v4l2_format_table[h->video_format].fmt.pix.width;
+           f->fmt.pix.height =
+                   v4l2_format_table[h->video_format].fmt.pix.height;
+           break ;
+        }
+        case VIDIOC_S_FMT:
+        {
+                struct v4l2_format *f = arg;
+
+                saa6752hs_set_subsampling(client, f);
+                break;
+        }
         default:
                 /* nothing */
                 break;
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 2021e099e35a..fa1357336907 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -233,10 +233,7 @@ static int ts_do_ioctl(struct inode *inode, struct file *file,
                 memset(f,0,sizeof(*f));
                 f->type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 
-                /* FIXME: translate subsampling type EMPRESS into
-                 *        width/height: */
-                f->fmt.pix.width        = 720; /* D1 */
-                f->fmt.pix.height       = 576;
+                saa7134_i2c_call_clients(dev, cmd, arg);
                 f->fmt.pix.pixelformat  = V4L2_PIX_FMT_MPEG;
                 f->fmt.pix.sizeimage    = TS_PACKET_SIZE * dev->ts.nr_packets;
                 return 0;
@@ -249,20 +246,7 @@ static int ts_do_ioctl(struct inode *inode, struct file *file,
                 if (f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                     return -EINVAL;
 
-                /*
-                  FIXME: translate and round width/height into EMPRESS
-                  subsample type:
-
-                          type  |   PAL   |  NTSC
-                        ---------------------------
-                          SIF   | 352x288 | 352x240
-                         1/2 D1 | 352x576 | 352x480
-                         2/3 D1 | 480x576 | 480x480
-                          D1    | 720x576 | 720x480
-                */
-
-                f->fmt.pix.width        = 720; /* D1 */
-                f->fmt.pix.height       = 576;
+                saa7134_i2c_call_clients(dev, cmd, arg);
                 f->fmt.pix.pixelformat  = V4L2_PIX_FMT_MPEG;
                 f->fmt.pix.sizeimage    = TS_PACKET_SIZE* dev->ts.nr_packets;
                 return 0;
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index 881a0539fc17..6212388edb75 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -357,8 +357,16 @@ tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                     V4L2_TUNER_RADIO != t->mode)
                         set_tv_freq(client,400*16);
                 t->mode  = f->type;
-                t->freq  = f->frequency;
-                set_freq(client,t->freq);
+                set_freq(client,f->frequency);
+                break;
+        }
+        case VIDIOC_G_FREQUENCY:
+        {
+                struct v4l2_frequency *f = arg;
+
+                SWITCH_V4L2;
+                f->type = t->mode;
+                f->frequency = t->freq;
                 break;
         }
         case VIDIOC_G_TUNER:
@@ -368,6 +376,8 @@ tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 SWITCH_V4L2;
                 if (V4L2_TUNER_RADIO == t->mode  &&  t->has_signal)
                         tuner->signal = t->has_signal(client);
+                tuner->rangelow = tv_range[0] * 16;
+                tuner->rangehigh = tv_range[1] * 16;
                 break;
         }
         default:
diff --git a/drivers/media/video/video-buf-dvb.c b/drivers/media/video/video-buf-dvb.c
index 31cc4ed9b747..5f870075b55e 100644
--- a/drivers/media/video/video-buf-dvb.c
+++ b/drivers/media/video/video-buf-dvb.c
@@ -149,10 +149,10 @@ int videobuf_dvb_register(struct videobuf_dvb *dvb,
                        dvb->name, result);
                 goto fail_adapter;
         }
-        dvb->adapter->priv = adapter_priv;
+        dvb->adapter.priv = adapter_priv;
 
         /* register frontend */
-        result = dvb_register_frontend(dvb->adapter, dvb->frontend);
+        result = dvb_register_frontend(&dvb->adapter, dvb->frontend);
         if (result < 0) {
                 printk(KERN_WARNING "%s: dvb_register_frontend failed (errno = %d)\n",
                        dvb->name, result);
@@ -178,7 +178,7 @@ int videobuf_dvb_register(struct videobuf_dvb *dvb,
         dvb->dmxdev.filternum    = 256;
         dvb->dmxdev.demux        = &dvb->demux.dmx;
         dvb->dmxdev.capabilities = 0;
-        result = dvb_dmxdev_init(&dvb->dmxdev, dvb->adapter);
+        result = dvb_dmxdev_init(&dvb->dmxdev, &dvb->adapter);
         if (result < 0) {
                 printk(KERN_WARNING "%s: dvb_dmxdev_init failed (errno = %d)\n",
                        dvb->name, result);
@@ -209,7 +209,7 @@ int videobuf_dvb_register(struct videobuf_dvb *dvb,
         }
 
         /* register network adapter */
-        dvb_net_init(dvb->adapter, &dvb->net, &dvb->demux.dmx);
+        dvb_net_init(&dvb->adapter, &dvb->net, &dvb->demux.dmx);
         return 0;
 
 fail_fe_conn:
@@ -223,7 +223,7 @@ fail_dmxdev:
 fail_dmx:
         dvb_unregister_frontend(dvb->frontend);
 fail_frontend:
-        dvb_unregister_adapter(dvb->adapter);
+        dvb_unregister_adapter(&dvb->adapter);
 fail_adapter:
         return result;
 }
@@ -236,7 +236,7 @@ void videobuf_dvb_unregister(struct videobuf_dvb *dvb)
         dvb_dmxdev_release(&dvb->dmxdev);
         dvb_dmx_release(&dvb->demux);
         dvb_unregister_frontend(dvb->frontend);
-        dvb_unregister_adapter(dvb->adapter);
+        dvb_unregister_adapter(&dvb->adapter);
 }
 
 EXPORT_SYMBOL(videobuf_dvb_register);
diff --git a/drivers/mmc/Kconfig b/drivers/mmc/Kconfig
index 2e70d74fbdee..4991bbd054f3 100644
--- a/drivers/mmc/Kconfig
+++ b/drivers/mmc/Kconfig
@@ -51,7 +51,7 @@ config MMC_PXA
 
 config MMC_WBSD
         tristate "Winbond W83L51xD SD/MMC Card Interface support"
-        depends on MMC && ISA && ISA_DMA_API
+        depends on MMC && ISA_DMA_API
         help
           This selects the Winbond(R) W83L51xD Secure digital and
           Multimedia card Interface.
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 39747526c719..b7fbd30b49a0 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -28,7 +28,9 @@
 #include <linux/ioport.h>
 #include <linux/device.h>
 #include <linux/interrupt.h>
+#include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/pnp.h>
 #include <linux/highmem.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/protocol.h>
@@ -40,7 +42,7 @@
 #include "wbsd.h"
 
 #define DRIVER_NAME "wbsd"
-#define DRIVER_VERSION "1.1"
+#define DRIVER_VERSION "1.2"
 
 #ifdef CONFIG_MMC_DEBUG
 #define DBG(x...) \
@@ -52,10 +54,6 @@
 #define DBGF(x...)      do { } while (0)
 #endif
 
-static unsigned int io = 0x248;
-static unsigned int irq = 6;
-static int dma = 2;
-
 #ifdef CONFIG_MMC_DEBUG
 void DBG_REG(int reg, u8 value)
 {
@@ -79,28 +77,61 @@ void DBG_REG(int reg, u8 value)
 #endif
 
 /*
+ * Device resources
+ */
+
+#ifdef CONFIG_PNP
+
+static const struct pnp_device_id pnp_dev_table[] = {
+        { "WEC0517", 0 },
+        { "WEC0518", 0 },
+        { "", 0 },
+};
+
+MODULE_DEVICE_TABLE(pnp, pnp_dev_table);
+
+#endif /* CONFIG_PNP */
+
+#ifdef CONFIG_PNP
+static unsigned int nopnp = 0;
+#else
+static const unsigned int nopnp = 1;
+#endif
+static unsigned int io = 0x248;
+static unsigned int irq = 6;
+static int dma = 2;
+
+/*
  * Basic functions
  */
 
 static inline void wbsd_unlock_config(struct wbsd_host* host)
 {
+        BUG_ON(host->config == 0);
+        
         outb(host->unlock_code, host->config);
         outb(host->unlock_code, host->config);
 }
 
 static inline void wbsd_lock_config(struct wbsd_host* host)
 {
+        BUG_ON(host->config == 0);
+        
         outb(LOCK_CODE, host->config);
 }
 
 static inline void wbsd_write_config(struct wbsd_host* host, u8 reg, u8 value)
 {
+        BUG_ON(host->config == 0);
+        
         outb(reg, host->config);
         outb(value, host->config + 1);
 }
 
 static inline u8 wbsd_read_config(struct wbsd_host* host, u8 reg)
 {
+        BUG_ON(host->config == 0);
+        
         outb(reg, host->config);
         return inb(host->config + 1);
 }
@@ -133,6 +164,13 @@ static void wbsd_init_device(struct wbsd_host* host)
         wbsd_write_index(host, WBSD_IDX_SETUP, setup);
         
         /*
+         * Set DAT3 to input
+         */
+        setup &= ~WBSD_DAT3_H;
+        wbsd_write_index(host, WBSD_IDX_SETUP, setup);
+        host->flags &= ~WBSD_FIGNORE_DETECT;
+        
+        /*
          * Read back default clock.
          */
         host->clk = wbsd_read_index(host, WBSD_IDX_CLK);
@@ -148,6 +186,14 @@ static void wbsd_init_device(struct wbsd_host* host)
         wbsd_write_index(host, WBSD_IDX_TAAC, 0x7F);
         
         /*
+         * Test for card presence
+         */
+        if (inb(host->base + WBSD_CSR) & WBSD_CARDPRESENT)
+                host->flags |= WBSD_FCARD_PRESENT;
+        else
+                host->flags &= ~WBSD_FCARD_PRESENT;
+        
+        /*
          * Enable interesting interrupts.
          */
         ier = 0;
@@ -407,8 +453,6 @@ static inline void wbsd_get_long_reply(struct wbsd_host* host,
         }
 }
 
-static irqreturn_t wbsd_irq(int irq, void *dev_id, struct pt_regs *regs);
-
 static void wbsd_send_command(struct wbsd_host* host, struct mmc_command* cmd)
 {
         int i;
@@ -646,6 +690,13 @@ static void wbsd_fill_fifo(struct wbsd_host* host)
         }
         
         wbsd_kunmap_sg(host);
+        
+        /*
+         * The controller stops sending interrupts for
+         * 'FIFO empty' under certain conditions. So we
+         * need to be a bit more pro-active.
+         */
+        tasklet_schedule(&host->fifo_tasklet);
 }
 
 static void wbsd_prepare_data(struct wbsd_host* host, struct mmc_data* data)
@@ -850,9 +901,11 @@ static void wbsd_finish_data(struct wbsd_host* host, struct mmc_data* data)
         wbsd_request_end(host, host->mrq);
 }
 
-/*
- * MMC Callbacks
- */
+/*****************************************************************************\
+ *                                                                           *
+ * MMC layer callbacks                                                       *
+ *                                                                           *
+\*****************************************************************************/
 
 static void wbsd_request(struct mmc_host* mmc, struct mmc_request* mrq)
 {
@@ -874,7 +927,7 @@ static void wbsd_request(struct mmc_host* mmc, struct mmc_request* mrq)
          * If there is no card in the slot then
          * timeout immediatly.
          */
-        if (!(inb(host->base + WBSD_CSR) & WBSD_CARDPRESENT))
+        if (!(host->flags & WBSD_FCARD_PRESENT))
         {
                 cmd->error = MMC_ERR_TIMEOUT;
                 goto done;
@@ -953,33 +1006,50 @@ static void wbsd_set_ios(struct mmc_host* mmc, struct mmc_ios* ios)
                 host->clk = clk;
         }
 
+        /*
+         * Power up card.
+         */
         if (ios->power_mode != MMC_POWER_OFF)
         {
-                /*
-                 * Power up card.
-                 */
                 pwr = inb(host->base + WBSD_CSR);
                 pwr &= ~WBSD_POWER_N;
                 outb(pwr, host->base + WBSD_CSR);
-
-                /*
-                 * This behaviour is stolen from the
-                 * Windows driver. Don't know why, but
-                 * it is needed.
-                 */
-                setup = wbsd_read_index(host, WBSD_IDX_SETUP);
-                if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN)
-                        setup |= WBSD_DAT3_H;
-                else
-                        setup &= ~WBSD_DAT3_H;
-                wbsd_write_index(host, WBSD_IDX_SETUP, setup);
-
-                mdelay(1);
         }
 
+        /*
+         * MMC cards need to have pin 1 high during init.
+         * Init time corresponds rather nicely with the bus mode.
+         * It wreaks havoc with the card detection though so
+         * that needs to be disabed.
+         */
+        setup = wbsd_read_index(host, WBSD_IDX_SETUP);
+        if ((ios->power_mode == MMC_POWER_ON) &&
+                (ios->bus_mode == MMC_BUSMODE_OPENDRAIN))
+        {
+                setup |= WBSD_DAT3_H;
+                host->flags |= WBSD_FIGNORE_DETECT;
+        }
+        else
+        {
+                setup &= ~WBSD_DAT3_H;
+                host->flags &= ~WBSD_FIGNORE_DETECT;
+        }
+        wbsd_write_index(host, WBSD_IDX_SETUP, setup);
+        
         spin_unlock_bh(&host->lock);
 }
 
+static struct mmc_host_ops wbsd_ops = {
+        .request        = wbsd_request,
+        .set_ios        = wbsd_set_ios,
+};
+
+/*****************************************************************************\
+ *                                                                           *
+ * Interrupt handling                                                        *
+ *                                                                           *
+\*****************************************************************************/
+
 /*
  * Tasklets
  */
@@ -1005,17 +1075,33 @@ static void wbsd_tasklet_card(unsigned long param)
 {
         struct wbsd_host* host = (struct wbsd_host*)param;
         u8 csr;
+        int change = 0;
         
         spin_lock(&host->lock);
         
+        if (host->flags & WBSD_FIGNORE_DETECT)
+        {
+                spin_unlock(&host->lock);
+                return;
+        }
+        
         csr = inb(host->base + WBSD_CSR);
         WARN_ON(csr == 0xff);
         
         if (csr & WBSD_CARDPRESENT)
-                DBG("Card inserted\n");
-        else
+        {
+                if (!(host->flags & WBSD_FCARD_PRESENT))
+                {
+                        DBG("Card inserted\n");
+                        host->flags |= WBSD_FCARD_PRESENT;
+                        change = 1;
+                }
+        }
+        else if (host->flags & WBSD_FCARD_PRESENT)
         {
                 DBG("Card removed\n");
+                host->flags &= ~WBSD_FCARD_PRESENT;
+                change = 1;
                 
                 if (host->mrq)
                 {
@@ -1033,7 +1119,8 @@ static void wbsd_tasklet_card(unsigned long param)
          */
         spin_unlock(&host->lock);
 
-        mmc_detect_change(host->mmc);
+        if (change)
+                mmc_detect_change(host->mmc);
 }
 
 static void wbsd_tasklet_fifo(unsigned long param)
@@ -1200,11 +1287,85 @@ static irqreturn_t wbsd_irq(int irq, void *dev_id, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
+/*****************************************************************************\
+ *                                                                           *
+ * Device initialisation and shutdown                                        *
+ *                                                                           *
+\*****************************************************************************/
+
 /*
- * Support functions for probe
+ * Allocate/free MMC structure.
  */
 
-static int wbsd_scan(struct wbsd_host* host)
+static int __devinit wbsd_alloc_mmc(struct device* dev)
+{
+        struct mmc_host* mmc;
+        struct wbsd_host* host;
+        
+        /*
+         * Allocate MMC structure.
+         */
+        mmc = mmc_alloc_host(sizeof(struct wbsd_host), dev);
+        if (!mmc)
+                return -ENOMEM;
+        
+        host = mmc_priv(mmc);
+        host->mmc = mmc;
+
+        host->dma = -1;
+
+        /*
+         * Set host parameters.
+         */
+        mmc->ops = &wbsd_ops;
+        mmc->f_min = 375000;
+        mmc->f_max = 24000000;
+        mmc->ocr_avail = MMC_VDD_32_33|MMC_VDD_33_34;
+        
+        spin_lock_init(&host->lock);
+        
+        /*
+         * Maximum number of segments. Worst case is one sector per segment
+         * so this will be 64kB/512.
+         */
+        mmc->max_hw_segs = 128;
+        mmc->max_phys_segs = 128;
+        
+        /*
+         * Maximum number of sectors in one transfer. Also limited by 64kB
+         * buffer.
+         */
+        mmc->max_sectors = 128;
+        
+        /*
+         * Maximum segment size. Could be one segment with the maximum number
+         * of segments.
+         */
+        mmc->max_seg_size = mmc->max_sectors * 512;
+        
+        dev_set_drvdata(dev, mmc);
+        
+        return 0;
+}
+
+static void __devexit wbsd_free_mmc(struct device* dev)
+{
+        struct mmc_host* mmc;
+        
+        mmc = dev_get_drvdata(dev);
+        if (!mmc)
+                return;
+        
+        mmc_free_host(mmc);
+        
+        dev_set_drvdata(dev, NULL);
+}
+
+/*
+ * Scan for known chip id:s
+ */
+
+static int __devinit wbsd_scan(struct wbsd_host* host)
 {
         int i, j, k;
         int id;
@@ -1258,12 +1419,16 @@ static int wbsd_scan(struct wbsd_host* host)
         return -ENODEV;
 }
 
-static int wbsd_request_regions(struct wbsd_host* host)
+/*
+ * Allocate/free io port ranges
+ */
+
+static int __devinit wbsd_request_region(struct wbsd_host* host, int base)
 {
         if (io & 0x7)
                 return -EINVAL;
         
-        if (!request_region(io, 8, DRIVER_NAME))
+        if (!request_region(base, 8, DRIVER_NAME))
                 return -EIO;
         
         host->base = io;
@@ -1271,19 +1436,25 @@ static int wbsd_request_regions(struct wbsd_host* host)
         return 0;
 }
 
-static void wbsd_release_regions(struct wbsd_host* host)
+static void __devexit wbsd_release_regions(struct wbsd_host* host)
 {
         if (host->base)
                 release_region(host->base, 8);
+        
+        host->base = 0;
 
         if (host->config)
                 release_region(host->config, 2);
+        
+        host->config = 0;
 }
 
-static void wbsd_init_dma(struct wbsd_host* host)
+/*
+ * Allocate/free DMA port and buffer
+ */
+
+static void __devinit wbsd_request_dma(struct wbsd_host* host, int dma)
 {
-        host->dma = -1;
-        
         if (dma < 0)
                 return;
         
@@ -1294,7 +1465,7 @@ static void wbsd_init_dma(struct wbsd_host* host)
          * We need to allocate a special buffer in
          * order for ISA to be able to DMA to it.
          */
-        host->dma_buffer = kmalloc(65536,
+        host->dma_buffer = kmalloc(WBSD_DMA_SIZE,
                 GFP_NOIO | GFP_DMA | __GFP_REPEAT | __GFP_NOWARN);
         if (!host->dma_buffer)
                 goto free;
@@ -1302,7 +1473,8 @@ static void wbsd_init_dma(struct wbsd_host* host)
         /*
          * Translate the address to a physical address.
          */
-        host->dma_addr = isa_virt_to_bus(host->dma_buffer);
+        host->dma_addr = dma_map_single(host->mmc->dev, host->dma_buffer,
+                WBSD_DMA_SIZE, DMA_BIDIRECTIONAL);
                         
         /*
          * ISA DMA must be aligned on a 64k basis.
@@ -1325,6 +1497,10 @@ kfree:
          */
         BUG_ON(1);
         
+        dma_unmap_single(host->mmc->dev, host->dma_addr, WBSD_DMA_SIZE,
+                DMA_BIDIRECTIONAL);
+        host->dma_addr = (dma_addr_t)NULL;
+        
         kfree(host->dma_buffer);
         host->dma_buffer = NULL;
 
@@ -1336,60 +1512,122 @@ err:
                 "Falling back on FIFO.\n", dma);
 }
 
-static struct mmc_host_ops wbsd_ops = {
-        .request        = wbsd_request,
-        .set_ios        = wbsd_set_ios,
-};
+static void __devexit wbsd_release_dma(struct wbsd_host* host)
+{
+        if (host->dma_addr)
+                dma_unmap_single(host->mmc->dev, host->dma_addr, WBSD_DMA_SIZE,
+                        DMA_BIDIRECTIONAL);
+        if (host->dma_buffer)
+                kfree(host->dma_buffer);
+        if (host->dma >= 0)
+                free_dma(host->dma);
+        
+        host->dma = -1;
+        host->dma_buffer = NULL;
+        host->dma_addr = (dma_addr_t)NULL;
+}
 
 /*
- * Device probe
+ * Allocate/free IRQ.
  */
 
-static int wbsd_probe(struct device* dev)
+static int __devinit wbsd_request_irq(struct wbsd_host* host, int irq)
 {
-        struct wbsd_host* host = NULL;
-        struct mmc_host* mmc = NULL;
         int ret;
         
         /*
-         * Allocate MMC structure.
+         * Allocate interrupt.
          */
-        mmc = mmc_alloc_host(sizeof(struct wbsd_host), dev);
-        if (!mmc)
-                return -ENOMEM;
-        
-        host = mmc_priv(mmc);
-        host->mmc = mmc;
+
+        ret = request_irq(irq, wbsd_irq, SA_SHIRQ, DRIVER_NAME, host);
+        if (ret)
+                return ret;
         
+        host->irq = irq;
+
         /*
-         * Scan for hardware.
+         * Set up tasklets.
          */
-        ret = wbsd_scan(host);
-        if (ret)
-                goto freemmc;
+        tasklet_init(&host->card_tasklet, wbsd_tasklet_card, (unsigned long)host);
+        tasklet_init(&host->fifo_tasklet, wbsd_tasklet_fifo, (unsigned long)host);
+        tasklet_init(&host->crc_tasklet, wbsd_tasklet_crc, (unsigned long)host);
+        tasklet_init(&host->timeout_tasklet, wbsd_tasklet_timeout, (unsigned long)host);
+        tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish, (unsigned long)host);
+        tasklet_init(&host->block_tasklet, wbsd_tasklet_block, (unsigned long)host);
+        
+        return 0;
+}
 
-        /*
-         * Reset the chip.
-         */     
-        wbsd_write_config(host, WBSD_CONF_SWRST, 1);
-        wbsd_write_config(host, WBSD_CONF_SWRST, 0);
+static void __devexit wbsd_release_irq(struct wbsd_host* host)
+{
+        if (!host->irq)
+                return;
 
+        free_irq(host->irq, host);
+        
+        host->irq = 0;
+                
+        tasklet_kill(&host->card_tasklet);
+        tasklet_kill(&host->fifo_tasklet);
+        tasklet_kill(&host->crc_tasklet);
+        tasklet_kill(&host->timeout_tasklet);
+        tasklet_kill(&host->finish_tasklet);
+        tasklet_kill(&host->block_tasklet);
+}
+
+/*
+ * Allocate all resources for the host.
+ */
+
+static int __devinit wbsd_request_resources(struct wbsd_host* host,
+        int base, int irq, int dma)
+{
+        int ret;
+        
         /*
          * Allocate I/O ports.
          */
-        ret = wbsd_request_regions(host);
+        ret = wbsd_request_region(host, base);
         if (ret)
-                goto release;
+                return ret;
 
         /*
-         * Set host parameters.
+         * Allocate interrupt.
          */
-        mmc->ops = &wbsd_ops;
-        mmc->f_min = 375000;
-        mmc->f_max = 24000000;
-        mmc->ocr_avail = MMC_VDD_32_33|MMC_VDD_33_34;
+        ret = wbsd_request_irq(host, irq);
+        if (ret)
+                return ret;
+
+        /*
+         * Allocate DMA.
+         */
+        wbsd_request_dma(host, dma);
         
-        spin_lock_init(&host->lock);
+        return 0;
+}
+
+/*
+ * Release all resources for the host.
+ */
+
+static void __devexit wbsd_release_resources(struct wbsd_host* host)
+{
+        wbsd_release_dma(host);
+        wbsd_release_irq(host);
+        wbsd_release_regions(host);
+}
+
+/*
+ * Configure the resources the chip should use.
+ */
+
+static void __devinit wbsd_chip_config(struct wbsd_host* host)
+{
+        /*
+         * Reset the chip.
+         */     
+        wbsd_write_config(host, WBSD_CONF_SWRST, 1);
+        wbsd_write_config(host, WBSD_CONF_SWRST, 0);
 
         /*
          * Select SD/MMC function.
@@ -1399,165 +1637,241 @@ static int wbsd_probe(struct device* dev)
         /*
          * Set up card detection.
          */
-        wbsd_write_config(host, WBSD_CONF_PINS, 0x02);
+        wbsd_write_config(host, WBSD_CONF_PINS, WBSD_PINS_DETECT_GP11);
         
         /*
-         * Configure I/O port.
+         * Configure chip
          */
         wbsd_write_config(host, WBSD_CONF_PORT_HI, host->base >> 8);
         wbsd_write_config(host, WBSD_CONF_PORT_LO, host->base & 0xff);
-
-        /*
-         * Allocate interrupt.
-         */
-        ret = request_irq(irq, wbsd_irq, SA_SHIRQ, DRIVER_NAME, host);
-        if (ret)
-                goto release;
         
-        host->irq = irq;
+        wbsd_write_config(host, WBSD_CONF_IRQ, host->irq);
         
-        /*
-         * Set up tasklets.
-         */
-        tasklet_init(&host->card_tasklet, wbsd_tasklet_card, (unsigned long)host);
-        tasklet_init(&host->fifo_tasklet, wbsd_tasklet_fifo, (unsigned long)host);
-        tasklet_init(&host->crc_tasklet, wbsd_tasklet_crc, (unsigned long)host);
-        tasklet_init(&host->timeout_tasklet, wbsd_tasklet_timeout, (unsigned long)host);
-        tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish, (unsigned long)host);
-        tasklet_init(&host->block_tasklet, wbsd_tasklet_block, (unsigned long)host);
+        if (host->dma >= 0)
+                wbsd_write_config(host, WBSD_CONF_DRQ, host->dma);
         
         /*
-         * Configure interrupt.
+         * Enable and power up chip.
          */
-        wbsd_write_config(host, WBSD_CONF_IRQ, host->irq);
+        wbsd_write_config(host, WBSD_CONF_ENABLE, 1);
+        wbsd_write_config(host, WBSD_CONF_POWER, 0x20);
+}
+
+/*
+ * Check that configured resources are correct.
+ */
+ 
+static int __devinit wbsd_chip_validate(struct wbsd_host* host)
+{
+        int base, irq, dma;
         
         /*
-         * Allocate DMA.
+         * Select SD/MMC function.
          */
-        wbsd_init_dma(host);
+        wbsd_write_config(host, WBSD_CONF_DEVICE, DEVICE_SD);
         
         /*
-         * If all went well, then configure DMA.
+         * Read configuration.
          */
-        if (host->dma >= 0)
-                wbsd_write_config(host, WBSD_CONF_DRQ, host->dma);
+        base = wbsd_read_config(host, WBSD_CONF_PORT_HI) << 8;
+        base |= wbsd_read_config(host, WBSD_CONF_PORT_LO);
         
-        /*
-         * Maximum number of segments. Worst case is one sector per segment
-         * so this will be 64kB/512.
-         */
-        mmc->max_hw_segs = 128;
-        mmc->max_phys_segs = 128;
+        irq = wbsd_read_config(host, WBSD_CONF_IRQ);
+        
+        dma = wbsd_read_config(host, WBSD_CONF_DRQ);
         
         /*
-         * Maximum number of sectors in one transfer. Also limited by 64kB
-         * buffer.
+         * Validate against given configuration.
          */
-        mmc->max_sectors = 128;
+        if (base != host->base)
+                return 0;
+        if (irq != host->irq)
+                return 0;
+        if ((dma != host->dma) && (host->dma != -1))
+                return 0;
+        
+        return 1;
+}
+
+/*****************************************************************************\
+ *                                                                           *
+ * Devices setup and shutdown                                                *
+ *                                                                           *
+\*****************************************************************************/
+
+static int __devinit wbsd_init(struct device* dev, int base, int irq, int dma,
+        int pnp)
+{
+        struct wbsd_host* host = NULL;
+        struct mmc_host* mmc = NULL;
+        int ret;
+        
+        ret = wbsd_alloc_mmc(dev);
+        if (ret)
+                return ret;
+        
+        mmc = dev_get_drvdata(dev);
+        host = mmc_priv(mmc);
         
         /*
-         * Maximum segment size. Could be one segment with the maximum number
-         * of segments.
+         * Scan for hardware.
          */
-        mmc->max_seg_size = mmc->max_sectors * 512;
+        ret = wbsd_scan(host);
+        if (ret)
+        {
+                if (pnp && (ret == -ENODEV))
+                {
+                        printk(KERN_WARNING DRIVER_NAME
+                                ": Unable to confirm device presence. You may "
+                                "experience lock-ups.\n");
+                }
+                else
+                {
+                        wbsd_free_mmc(dev);
+                        return ret;
+                }
+        }
         
         /*
-         * Enable chip.
+         * Request resources.
          */
-        wbsd_write_config(host, WBSD_CONF_ENABLE, 1);
+        ret = wbsd_request_resources(host, io, irq, dma);
+        if (ret)
+        {
+                wbsd_release_resources(host);
+                wbsd_free_mmc(dev);
+                return ret;
+        }
         
         /*
-         * Power up chip.
+         * See if chip needs to be configured.
          */
-        wbsd_write_config(host, WBSD_CONF_POWER, 0x20);
+        if (pnp && (host->config != 0))
+        {
+                if (!wbsd_chip_validate(host))
+                {
+                        printk(KERN_WARNING DRIVER_NAME
+                                ": PnP active but chip not configured! "
+                                "You probably have a buggy BIOS. "
+                                "Configuring chip manually.\n");
+                        wbsd_chip_config(host);
+                }
+        }
+        else
+                wbsd_chip_config(host);
         
         /*
          * Power Management stuff. No idea how this works.
          * Not tested.
          */
 #ifdef CONFIG_PM
-        wbsd_write_config(host, WBSD_CONF_PME, 0xA0);
+        if (host->config)
+                wbsd_write_config(host, WBSD_CONF_PME, 0xA0);
 #endif
+        /*
+         * Allow device to initialise itself properly.
+         */
+        mdelay(5);
 
         /*
          * Reset the chip into a known state.
          */
         wbsd_init_device(host);
         
-        dev_set_drvdata(dev, mmc);
-        
-        /*
-         * Add host to MMC layer.
-         */
         mmc_add_host(mmc);
 
-        printk(KERN_INFO "%s: W83L51xD id %x at 0x%x irq %d dma %d\n",
-                mmc->host_name, (int)host->chip_id, (int)host->base,
-                (int)host->irq, (int)host->dma);
+        printk(KERN_INFO "%s: W83L51xD", mmc->host_name);
+        if (host->chip_id != 0)
+                printk(" id %x", (int)host->chip_id);
+        printk(" at 0x%x irq %d", (int)host->base, (int)host->irq);
+        if (host->dma >= 0)
+                printk(" dma %d", (int)host->dma);
+        else
+                printk(" FIFO");
+        if (pnp)
+                printk(" PnP");
+        printk("\n");
 
         return 0;
-
-release:
-        wbsd_release_regions(host);
-
-freemmc:
-        mmc_free_host(mmc);
-
-        return ret;
 }
 
-/*
- * Device remove
- */
-
-static int wbsd_remove(struct device* dev)
+static void __devexit wbsd_shutdown(struct device* dev, int pnp)
 {
         struct mmc_host* mmc = dev_get_drvdata(dev);
         struct wbsd_host* host;
         
         if (!mmc)
-                return 0;
+                return;
 
         host = mmc_priv(mmc);
         
-        /*
-         * Unregister host with MMC layer.
-         */
         mmc_remove_host(mmc);
 
-        /*
-         * Power down the SD/MMC function.
-         */
-        wbsd_unlock_config(host);
-        wbsd_write_config(host, WBSD_CONF_DEVICE, DEVICE_SD);
-        wbsd_write_config(host, WBSD_CONF_ENABLE, 0);
-        wbsd_lock_config(host);
+        if (!pnp)
+        {
+                /*
+                 * Power down the SD/MMC function.
+                 */
+                wbsd_unlock_config(host);
+                wbsd_write_config(host, WBSD_CONF_DEVICE, DEVICE_SD);
+                wbsd_write_config(host, WBSD_CONF_ENABLE, 0);
+                wbsd_lock_config(host);
+        }
         
-        /*
-         * Free resources.
-         */
-        if (host->dma_buffer)
-                kfree(host->dma_buffer);
+        wbsd_release_resources(host);
         
-        if (host->dma >= 0)
-                free_dma(host->dma);
+        wbsd_free_mmc(dev);
+}
 
-        free_irq(host->irq, host);
+/*
+ * Non-PnP
+ */
+
+static int __devinit wbsd_probe(struct device* dev)
+{
+        return wbsd_init(dev, io, irq, dma, 0);
+}
+
+static int __devexit wbsd_remove(struct device* dev)
+{
+        wbsd_shutdown(dev, 0);
+
+        return 0;
+}
+
+/*
+ * PnP
+ */
+
+#ifdef CONFIG_PNP
+
+static int __devinit
+wbsd_pnp_probe(struct pnp_dev * pnpdev, const struct pnp_device_id *dev_id)
+{
+        int io, irq, dma;
         
-        tasklet_kill(&host->card_tasklet);
-        tasklet_kill(&host->fifo_tasklet);
-        tasklet_kill(&host->crc_tasklet);
-        tasklet_kill(&host->timeout_tasklet);
-        tasklet_kill(&host->finish_tasklet);
-        tasklet_kill(&host->block_tasklet);
+        /*
+         * Get resources from PnP layer.
+         */
+        io = pnp_port_start(pnpdev, 0);
+        irq = pnp_irq(pnpdev, 0);
+        if (pnp_dma_valid(pnpdev, 0))
+                dma = pnp_dma(pnpdev, 0);
+        else
+                dma = -1;
         
-        wbsd_release_regions(host);
+        DBGF("PnP resources: port %3x irq %d dma %d\n", io, irq, dma);
         
-        mmc_free_host(mmc);
+        return wbsd_init(&pnpdev->dev, io, irq, dma, 1);
+}
 
-        return 0;
+static void __devexit wbsd_pnp_remove(struct pnp_dev * dev)
+{
+        wbsd_shutdown(&dev->dev, 1);
 }
 
+#endif /* CONFIG_PNP */
+
 /*
  * Power management
  */
@@ -1581,17 +1895,7 @@ static int wbsd_resume(struct device *dev, u32 level)
 #define wbsd_resume NULL
 #endif
 
-static void wbsd_release(struct device *dev)
-{
-}
-
-static struct platform_device wbsd_device = {
-        .name           = DRIVER_NAME,
-        .id                     = -1,
-        .dev            = {
-                .release = wbsd_release,
-        },
-};
+static struct platform_device *wbsd_device;
 
 static struct device_driver wbsd_driver = {
         .name           = DRIVER_NAME,
@@ -1603,6 +1907,17 @@ static struct device_driver wbsd_driver = {
         .resume         = wbsd_resume,
 };
 
+#ifdef CONFIG_PNP
+
+static struct pnp_driver wbsd_pnp_driver = {
+        .name           = DRIVER_NAME,
+        .id_table       = pnp_dev_table,
+        .probe          = wbsd_pnp_probe,
+        .remove         = wbsd_pnp_remove,
+};
+
+#endif /* CONFIG_PNP */
+
 /*
  * Module loading/unloading
  */
@@ -1615,29 +1930,57 @@ static int __init wbsd_drv_init(void)
                 ": Winbond W83L51xD SD/MMC card interface driver, "
                 DRIVER_VERSION "\n");
         printk(KERN_INFO DRIVER_NAME ": Copyright(c) Pierre Ossman\n");
-        
-        result = driver_register(&wbsd_driver);
-        if (result < 0)
-                return result;
 
-        result = platform_device_register(&wbsd_device);
-        if (result < 0)
-                return result;
+#ifdef CONFIG_PNP
+
+        if (!nopnp)
+        {
+                result = pnp_register_driver(&wbsd_pnp_driver);
+                if (result < 0)
+                        return result;
+        }
+
+#endif /* CONFIG_PNP */ 
+        
+        if (nopnp)
+        {
+                result = driver_register(&wbsd_driver);
+                if (result < 0)
+                        return result;
+
+                wbsd_device = platform_device_register_simple(DRIVER_NAME, -1,
+                        NULL, 0);
+                if (IS_ERR(wbsd_device))
+                        return PTR_ERR(wbsd_device);
+        }
 
         return 0;
 }
 
 static void __exit wbsd_drv_exit(void)
 {
-        platform_device_unregister(&wbsd_device);
+#ifdef CONFIG_PNP
+
+        if (!nopnp)
+                pnp_unregister_driver(&wbsd_pnp_driver);
         
-        driver_unregister(&wbsd_driver);
+#endif /* CONFIG_PNP */ 
+
+        if (nopnp)
+        {
+                platform_device_unregister(wbsd_device);
+        
+                driver_unregister(&wbsd_driver);
+        }
 
         DBG("unloaded\n");
 }
 
 module_init(wbsd_drv_init);
 module_exit(wbsd_drv_exit);
+#ifdef CONFIG_PNP
+module_param(nopnp, uint, 0444);
+#endif
 module_param(io, uint, 0444);
 module_param(irq, uint, 0444);
 module_param(dma, int, 0444);
@@ -1646,6 +1989,9 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Winbond W83L51xD SD/MMC card interface driver");
 MODULE_VERSION(DRIVER_VERSION);
 
+#ifdef CONFIG_PNP
+MODULE_PARM_DESC(nopnp, "Scan for device instead of relying on PNP. (default 0)");
+#endif
 MODULE_PARM_DESC(io, "I/O base to allocate. Must be 8 byte aligned. (default 0x248)");
 MODULE_PARM_DESC(irq, "IRQ to allocate. (default 6)");
 MODULE_PARM_DESC(dma, "DMA channel to allocate. -1 for no DMA. (default 2)");
diff --git a/drivers/mmc/wbsd.h b/drivers/mmc/wbsd.h
index fdc03b56a81f..864f30828d01 100644
--- a/drivers/mmc/wbsd.h
+++ b/drivers/mmc/wbsd.h
@@ -35,6 +35,12 @@ const int valid_ids[] = {
 
 #define DEVICE_SD               0x03
 
+#define WBSD_PINS_DAT3_HI       0x20
+#define WBSD_PINS_DAT3_OUT      0x10
+#define WBSD_PINS_GP11_HI       0x04
+#define WBSD_PINS_DETECT_GP11   0x02
+#define WBSD_PINS_DETECT_DAT3   0x01
+
 #define WBSD_CMDR               0x00
 #define WBSD_DFR                0x01
 #define WBSD_EIR                0x02
@@ -133,6 +139,7 @@ const int valid_ids[] = {
 #define WBSD_CRC_OK             0x05 /* S010E (00101) */
 #define WBSD_CRC_FAIL           0x0B /* S101E (01011) */
 
+#define WBSD_DMA_SIZE           65536
 
 struct wbsd_host
 {
@@ -140,6 +147,11 @@ struct wbsd_host
         
         spinlock_t              lock;           /* Mutex */
 
+        int                     flags;          /* Driver states */
+
+#define WBSD_FCARD_PRESENT      (1<<0)          /* Card is present */
+#define WBSD_FIGNORE_DETECT     (1<<1)          /* Ignore card detection */
+        
         struct mmc_request*     mrq;            /* Current request */
         
         u8                      isr;            /* Accumulated ISR */
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 43e2ac532f82..b5e076043431 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -1581,7 +1581,8 @@ vortex_up(struct net_device *dev)
 
         if (VORTEX_PCI(vp)) {
                 pci_set_power_state(VORTEX_PCI(vp), PCI_D0);    /* Go active */
-                pci_restore_state(VORTEX_PCI(vp));
+                if (vp->pm_state_valid)
+                        pci_restore_state(VORTEX_PCI(vp));
                 pci_enable_device(VORTEX_PCI(vp));
         }
 
@@ -2741,6 +2742,7 @@ vortex_down(struct net_device *dev, int final_down)
                 outl(0, ioaddr + DownListPtr);
 
         if (final_down && VORTEX_PCI(vp)) {
+                vp->pm_state_valid = 1;
                 pci_save_state(VORTEX_PCI(vp));
                 acpi_set_WOL(dev);
         }
@@ -3243,9 +3245,10 @@ static void acpi_set_WOL(struct net_device *dev)
                 outw(RxEnable, ioaddr + EL3_CMD);
 
                 pci_enable_wake(VORTEX_PCI(vp), 0, 1);
+
+                /* Change the power state to D3; RxEnable doesn't take effect. */
+                pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
         }
-        /* Change the power state to D3; RxEnable doesn't take effect. */
-        pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
 }
 
 
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 6202b10dbb4d..e038d55e4f6f 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -187,7 +187,7 @@ obj-$(CONFIG_TR) += tokenring/
 obj-$(CONFIG_WAN) += wan/
 obj-$(CONFIG_ARCNET) += arcnet/
 obj-$(CONFIG_NET_PCMCIA) += pcmcia/
-obj-$(CONFIG_NET_WIRELESS) += wireless/
+obj-$(CONFIG_NET_RADIO) += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
 obj-$(CONFIG_HAMRADIO) += hamradio/
 obj-$(CONFIG_IRDA) += irda/
diff --git a/drivers/net/Space.c b/drivers/net/Space.c
index fc519377b5aa..fb433325aa27 100644
--- a/drivers/net/Space.c
+++ b/drivers/net/Space.c
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)Space.c     1.0.7   08/12/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Donald J. Becker, <becker@scyld.com>
  *
diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
index 2161c2d585f0..9edaa183227a 100644
--- a/drivers/net/appletalk/cops.c
+++ b/drivers/net/appletalk/cops.c
@@ -65,7 +65,7 @@ static const char *version =
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
-#include <linux/if_ltalk.h>     /* For ltalk_setup() */
+#include <linux/if_ltalk.h>
 #include <linux/delay.h>        /* For udelay() */
 #include <linux/atalk.h>
 #include <linux/spinlock.h>
@@ -223,7 +223,7 @@ struct net_device * __init cops_probe(int unit)
         int base_addr;
         int err = 0;
 
-        dev = alloc_netdev(sizeof(struct cops_local), "lt%d", ltalk_setup);
+        dev = alloc_ltalkdev(sizeof(struct cops_local));
         if (!dev)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/drivers/net/appletalk/cops_ffdrv.h b/drivers/net/appletalk/cops_ffdrv.h
index 4131b4a7a65b..31cf8c9c947f 100644
--- a/drivers/net/appletalk/cops_ffdrv.h
+++ b/drivers/net/appletalk/cops_ffdrv.h
@@ -28,7 +28,7 @@
 
 #ifdef CONFIG_COPS_DAYNA
 
-unsigned char ffdrv_code[] = {
+static const unsigned char ffdrv_code[] = {
         58,3,0,50,228,149,33,255,255,34,226,149,
         249,17,40,152,33,202,154,183,237,82,77,68,
         11,107,98,19,54,0,237,176,175,50,80,0,
diff --git a/drivers/net/appletalk/cops_ltdrv.h b/drivers/net/appletalk/cops_ltdrv.h
index 05de66dd9206..4afb8e18ba65 100644
--- a/drivers/net/appletalk/cops_ltdrv.h
+++ b/drivers/net/appletalk/cops_ltdrv.h
@@ -27,7 +27,7 @@
 
 #ifdef CONFIG_COPS_TANGENT
 
-unsigned char ltdrv_code[] = {
+static const unsigned char ltdrv_code[] = {
         58,3,0,50,148,10,33,143,15,62,85,119,
         190,32,9,62,170,119,190,32,3,35,24,241,
         34,146,10,249,17,150,10,33,143,15,183,237,
diff --git a/drivers/net/appletalk/ltpc.c b/drivers/net/appletalk/ltpc.c
index ad8e943231a1..db4f369637b6 100644
--- a/drivers/net/appletalk/ltpc.c
+++ b/drivers/net/appletalk/ltpc.c
@@ -1039,7 +1039,7 @@ struct net_device * __init ltpc_probe(void)
         unsigned long f;
         unsigned long timeout;
 
-        dev = alloc_netdev(sizeof(struct ltpc_private), "lt%d", ltalk_setup);
+        dev = alloc_ltalkdev(sizeof(struct ltpc_private));
         if (!dev)
                 goto out;
 
diff --git a/drivers/net/arcnet/capmode.c b/drivers/net/arcnet/capmode.c
index 16e155b04129..66485585ab39 100644
--- a/drivers/net/arcnet/capmode.c
+++ b/drivers/net/arcnet/capmode.c
@@ -48,7 +48,7 @@ static int prepare_tx(struct net_device *dev, struct archdr *pkt, int length,
 static int ack_tx(struct net_device *dev, int acked);
 
 
-struct ArcProto capmode_proto =
+static struct ArcProto capmode_proto =
 {
         'r',
         XMTU,
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index ab44358ddbfc..6482d994d489 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -1595,7 +1595,7 @@ static struct ethtool_ops emac_ethtool_ops = {
 static int emac_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
         struct ocp_enet_private *fep = dev->priv;
-        uint *data = (uint *) & rq->ifr_ifru;
+        uint16_t *data = (uint16_t *) & rq->ifr_ifru;
 
         switch (cmd) {
         case SIOCGMIIPHY:
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 2ffc31708d5f..b33111e21313 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)loopback.c  1.0.4b  08/16/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Donald Becker, <becker@scyld.com>
  *
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 058c70c6f1ac..4d2bdbdd34e8 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -61,8 +61,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.26"
-#define DRV_MODULE_RELDATE      "April 24, 2005"
+#define DRV_MODULE_VERSION      "3.27"
+#define DRV_MODULE_RELDATE      "May 5, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -420,7 +420,8 @@ static void tg3_enable_ints(struct tg3 *tp)
 {
         tw32(TG3PCI_MISC_HOST_CTRL,
              (tp->misc_host_ctrl & ~MISC_HOST_CTRL_MASK_PCI_INT));
-        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000000);
+        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                     (tp->last_tag << 24));
         tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
 
         tg3_cond_int(tp);
@@ -455,10 +456,16 @@ static void tg3_restart_ints(struct tg3 *tp)
 {
         tw32(TG3PCI_MISC_HOST_CTRL,
                 (tp->misc_host_ctrl & ~MISC_HOST_CTRL_MASK_PCI_INT));
-        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000000);
+        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                     tp->last_tag << 24);
         mmiowb();
 
-        if (tg3_has_work(tp))
+        /* When doing tagged status, this work check is unnecessary.
+         * The last_tag we write above tells the chip which piece of
+         * work we've completed.
+         */
+        if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS) &&
+            tg3_has_work(tp))
                 tw32(HOSTCC_MODE, tp->coalesce_mode |
                      (HOSTCC_MODE_ENABLE | HOSTCC_MODE_NOW));
 }
@@ -2500,7 +2507,7 @@ static int tg3_setup_phy(struct tg3 *tp, int force_reset)
         if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
                 if (netif_carrier_ok(tp->dev)) {
                         tw32(HOSTCC_STAT_COAL_TICKS,
-                             DEFAULT_STAT_COAL_TICKS);
+                             tp->coal.stats_block_coalesce_usecs);
                 } else {
                         tw32(HOSTCC_STAT_COAL_TICKS, 0);
                 }
@@ -2886,7 +2893,6 @@ static int tg3_poll(struct net_device *netdev, int *budget)
          * All RX "locking" is done by ensuring outside
          * code synchronizes with dev->poll()
          */
-        done = 1;
         if (sblk->idx[0].rx_producer != tp->rx_rcb_ptr) {
                 int orig_budget = *budget;
                 int work_done;
@@ -2898,12 +2904,14 @@ static int tg3_poll(struct net_device *netdev, int *budget)
 
                 *budget -= work_done;
                 netdev->quota -= work_done;
-
-                if (work_done >= orig_budget)
-                        done = 0;
         }
 
+        if (tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)
+                tp->last_tag = sblk->status_tag;
+        rmb();
+
         /* if no more work, tell net stack and NIC we're done */
+        done = !tg3_has_work(tp);
         if (done) {
                 spin_lock_irqsave(&tp->lock, flags);
                 __netif_rx_complete(netdev);
@@ -2928,22 +2936,21 @@ static irqreturn_t tg3_msi(int irq, void *dev_id, struct pt_regs *regs)
         spin_lock_irqsave(&tp->lock, flags);
 
         /*
-         * writing any value to intr-mbox-0 clears PCI INTA# and
+         * Writing any value to intr-mbox-0 clears PCI INTA# and
          * chip-internal interrupt pending events.
-         * writing non-zero to intr-mbox-0 additional tells the
+         * Writing non-zero to intr-mbox-0 additional tells the
          * NIC to stop sending us irqs, engaging "in-intr-handler"
          * event coalescing.
          */
         tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0x00000001);
+        tp->last_tag = sblk->status_tag;
         sblk->status &= ~SD_STATUS_UPDATED;
-
         if (likely(tg3_has_work(tp)))
                 netif_rx_schedule(dev);         /* schedule NAPI poll */
         else {
-                /* no work, re-enable interrupts
-                 */
+                /* No work, re-enable interrupts.  */
                 tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                             0x00000000);
+                             tp->last_tag << 24);
         }
 
         spin_unlock_irqrestore(&tp->lock, flags);
@@ -2969,21 +2976,62 @@ static irqreturn_t tg3_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         if ((sblk->status & SD_STATUS_UPDATED) ||
             !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
                 /*
-                 * writing any value to intr-mbox-0 clears PCI INTA# and
+                 * Writing any value to intr-mbox-0 clears PCI INTA# and
                  * chip-internal interrupt pending events.
-                 * writing non-zero to intr-mbox-0 additional tells the
+                 * Writing non-zero to intr-mbox-0 additional tells the
                  * NIC to stop sending us irqs, engaging "in-intr-handler"
                  * event coalescing.
                  */
                 tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
                              0x00000001);
+                sblk->status &= ~SD_STATUS_UPDATED;
+                if (likely(tg3_has_work(tp)))
+                        netif_rx_schedule(dev);         /* schedule NAPI poll */
+                else {
+                        /* No work, shared interrupt perhaps?  re-enable
+                         * interrupts, and flush that PCI write
+                         */
+                        tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                                0x00000000);
+                        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+                }
+        } else {        /* shared interrupt */
+                handled = 0;
+        }
+
+        spin_unlock_irqrestore(&tp->lock, flags);
+
+        return IRQ_RETVAL(handled);
+}
+
+static irqreturn_t tg3_interrupt_tagged(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct net_device *dev = dev_id;
+        struct tg3 *tp = netdev_priv(dev);
+        struct tg3_hw_status *sblk = tp->hw_status;
+        unsigned long flags;
+        unsigned int handled = 1;
+
+        spin_lock_irqsave(&tp->lock, flags);
+
+        /* In INTx mode, it is possible for the interrupt to arrive at
+         * the CPU before the status block posted prior to the interrupt.
+         * Reading the PCI State register will confirm whether the
+         * interrupt is ours and will flush the status block.
+         */
+        if ((sblk->status & SD_STATUS_UPDATED) ||
+            !(tr32(TG3PCI_PCISTATE) & PCISTATE_INT_NOT_ACTIVE)) {
                 /*
-                 * Flush PCI write.  This also guarantees that our
-                 * status block has been flushed to host memory.
+                 * writing any value to intr-mbox-0 clears PCI INTA# and
+                 * chip-internal interrupt pending events.
+                 * writing non-zero to intr-mbox-0 additional tells the
+                 * NIC to stop sending us irqs, engaging "in-intr-handler"
+                 * event coalescing.
                  */
-                tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+                tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
+                             0x00000001);
+                tp->last_tag = sblk->status_tag;
                 sblk->status &= ~SD_STATUS_UPDATED;
-
                 if (likely(tg3_has_work(tp)))
                         netif_rx_schedule(dev);         /* schedule NAPI poll */
                 else {
@@ -2991,7 +3039,7 @@ static irqreturn_t tg3_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                          * interrupts, and flush that PCI write
                          */
                         tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW,
-                                0x00000000);
+                                     tp->last_tag << 24);
                         tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
                 }
         } else {        /* shared interrupt */
@@ -3020,7 +3068,7 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
 }
 
 static int tg3_init_hw(struct tg3 *);
-static int tg3_halt(struct tg3 *);
+static int tg3_halt(struct tg3 *, int);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void tg3_poll_controller(struct net_device *dev)
@@ -3044,7 +3092,7 @@ static void tg3_reset_task(void *_data)
         restart_timer = tp->tg3_flags2 & TG3_FLG2_RESTART_TIMER;
         tp->tg3_flags2 &= ~TG3_FLG2_RESTART_TIMER;
 
-        tg3_halt(tp);
+        tg3_halt(tp, 0);
         tg3_init_hw(tp);
 
         tg3_netif_start(tp);
@@ -3390,7 +3438,7 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
         spin_lock_irq(&tp->lock);
         spin_lock(&tp->tx_lock);
 
-        tg3_halt(tp);
+        tg3_halt(tp, 1);
 
         tg3_set_mtu(dev, tp, new_mtu);
 
@@ -3657,7 +3705,7 @@ err_out:
 /* To stop a block, clear the enable bit and poll till it
  * clears.  tp->lock is held.
  */
-static int tg3_stop_block(struct tg3 *tp, unsigned long ofs, u32 enable_bit)
+static int tg3_stop_block(struct tg3 *tp, unsigned long ofs, u32 enable_bit, int silent)
 {
         unsigned int i;
         u32 val;
@@ -3690,7 +3738,7 @@ static int tg3_stop_block(struct tg3 *tp, unsigned long ofs, u32 enable_bit)
                         break;
         }
 
-        if (i == MAX_WAIT_CNT) {
+        if (i == MAX_WAIT_CNT && !silent) {
                 printk(KERN_ERR PFX "tg3_stop_block timed out, "
                        "ofs=%lx enable_bit=%x\n",
                        ofs, enable_bit);
@@ -3701,7 +3749,7 @@ static int tg3_stop_block(struct tg3 *tp, unsigned long ofs, u32 enable_bit)
 }
 
 /* tp->lock is held. */
-static int tg3_abort_hw(struct tg3 *tp)
+static int tg3_abort_hw(struct tg3 *tp, int silent)
 {
         int i, err;
 
@@ -3711,22 +3759,20 @@ static int tg3_abort_hw(struct tg3 *tp)
         tw32_f(MAC_RX_MODE, tp->rx_mode);
         udelay(10);
 
-        err  = tg3_stop_block(tp, RCVBDI_MODE, RCVBDI_MODE_ENABLE);
-        err |= tg3_stop_block(tp, RCVLPC_MODE, RCVLPC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, RCVLSC_MODE, RCVLSC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, RCVDBDI_MODE, RCVDBDI_MODE_ENABLE);
-        err |= tg3_stop_block(tp, RCVDCC_MODE, RCVDCC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, RCVCC_MODE, RCVCC_MODE_ENABLE);
-
-        err |= tg3_stop_block(tp, SNDBDS_MODE, SNDBDS_MODE_ENABLE);
-        err |= tg3_stop_block(tp, SNDBDI_MODE, SNDBDI_MODE_ENABLE);
-        err |= tg3_stop_block(tp, SNDDATAI_MODE, SNDDATAI_MODE_ENABLE);
-        err |= tg3_stop_block(tp, RDMAC_MODE, RDMAC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, SNDDATAC_MODE, SNDDATAC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, DMAC_MODE, DMAC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, SNDBDC_MODE, SNDBDC_MODE_ENABLE);
-        if (err)
-                goto out;
+        err  = tg3_stop_block(tp, RCVBDI_MODE, RCVBDI_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, RCVLPC_MODE, RCVLPC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, RCVLSC_MODE, RCVLSC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, RCVDBDI_MODE, RCVDBDI_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, RCVDCC_MODE, RCVDCC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, RCVCC_MODE, RCVCC_MODE_ENABLE, silent);
+
+        err |= tg3_stop_block(tp, SNDBDS_MODE, SNDBDS_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, SNDBDI_MODE, SNDBDI_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, SNDDATAI_MODE, SNDDATAI_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, RDMAC_MODE, RDMAC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, SNDDATAC_MODE, SNDDATAC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, DMAC_MODE, DMAC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, SNDBDC_MODE, SNDBDC_MODE_ENABLE, silent);
 
         tp->mac_mode &= ~MAC_MODE_TDE_ENABLE;
         tw32_f(MAC_MODE, tp->mac_mode);
@@ -3744,27 +3790,24 @@ static int tg3_abort_hw(struct tg3 *tp)
                 printk(KERN_ERR PFX "tg3_abort_hw timed out for %s, "
                        "TX_MODE_ENABLE will not clear MAC_TX_MODE=%08x\n",
                        tp->dev->name, tr32(MAC_TX_MODE));
-                return -ENODEV;
+                err |= -ENODEV;
         }
 
-        err  = tg3_stop_block(tp, HOSTCC_MODE, HOSTCC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, WDMAC_MODE, WDMAC_MODE_ENABLE);
-        err |= tg3_stop_block(tp, MBFREE_MODE, MBFREE_MODE_ENABLE);
+        err |= tg3_stop_block(tp, HOSTCC_MODE, HOSTCC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, WDMAC_MODE, WDMAC_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, MBFREE_MODE, MBFREE_MODE_ENABLE, silent);
 
         tw32(FTQ_RESET, 0xffffffff);
         tw32(FTQ_RESET, 0x00000000);
 
-        err |= tg3_stop_block(tp, BUFMGR_MODE, BUFMGR_MODE_ENABLE);
-        err |= tg3_stop_block(tp, MEMARB_MODE, MEMARB_MODE_ENABLE);
-        if (err)
-                goto out;
+        err |= tg3_stop_block(tp, BUFMGR_MODE, BUFMGR_MODE_ENABLE, silent);
+        err |= tg3_stop_block(tp, MEMARB_MODE, MEMARB_MODE_ENABLE, silent);
 
         if (tp->hw_status)
                 memset(tp->hw_status, 0, TG3_HW_STATUS_SIZE);
         if (tp->hw_stats)
                 memset(tp->hw_stats, 0, sizeof(struct tg3_hw_stats));
 
-out:
         return err;
 }
 
@@ -4086,7 +4129,7 @@ static void tg3_stop_fw(struct tg3 *tp)
 }
 
 /* tp->lock is held. */
-static int tg3_halt(struct tg3 *tp)
+static int tg3_halt(struct tg3 *tp, int silent)
 {
         int err;
 
@@ -4094,7 +4137,7 @@ static int tg3_halt(struct tg3 *tp)
 
         tg3_write_sig_pre_reset(tp, RESET_KIND_SHUTDOWN);
 
-        tg3_abort_hw(tp);
+        tg3_abort_hw(tp, silent);
         err = tg3_chip_reset(tp);
 
         tg3_write_sig_legacy(tp, RESET_KIND_SHUTDOWN);
@@ -5049,6 +5092,27 @@ static void tg3_set_bdinfo(struct tg3 *tp, u32 bdinfo_addr,
 }
 
 static void __tg3_set_rx_mode(struct net_device *);
+static void tg3_set_coalesce(struct tg3 *tp, struct ethtool_coalesce *ec)
+{
+        tw32(HOSTCC_RXCOL_TICKS, ec->rx_coalesce_usecs);
+        tw32(HOSTCC_TXCOL_TICKS, ec->tx_coalesce_usecs);
+        tw32(HOSTCC_RXMAX_FRAMES, ec->rx_max_coalesced_frames);
+        tw32(HOSTCC_TXMAX_FRAMES, ec->tx_max_coalesced_frames);
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
+                tw32(HOSTCC_RXCOAL_TICK_INT, ec->rx_coalesce_usecs_irq);
+                tw32(HOSTCC_TXCOAL_TICK_INT, ec->tx_coalesce_usecs_irq);
+        }
+        tw32(HOSTCC_RXCOAL_MAXF_INT, ec->rx_max_coalesced_frames_irq);
+        tw32(HOSTCC_TXCOAL_MAXF_INT, ec->tx_max_coalesced_frames_irq);
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
+                u32 val = ec->stats_block_coalesce_usecs;
+
+                if (!netif_carrier_ok(tp->dev))
+                        val = 0;
+
+                tw32(HOSTCC_STAT_COAL_TICKS, val);
+        }
+}
 
 /* tp->lock is held. */
 static int tg3_reset_hw(struct tg3 *tp)
@@ -5063,9 +5127,7 @@ static int tg3_reset_hw(struct tg3 *tp)
         tg3_write_sig_pre_reset(tp, RESET_KIND_INIT);
 
         if (tp->tg3_flags & TG3_FLAG_INIT_COMPLETE) {
-                err = tg3_abort_hw(tp);
-                if (err)
-                        return err;
+                tg3_abort_hw(tp, 1);
         }
 
         err = tg3_chip_reset(tp);
@@ -5373,16 +5435,7 @@ static int tg3_reset_hw(struct tg3 *tp)
                 udelay(10);
         }
 
-        tw32(HOSTCC_RXCOL_TICKS, 0);
-        tw32(HOSTCC_TXCOL_TICKS, LOW_TXCOL_TICKS);
-        tw32(HOSTCC_RXMAX_FRAMES, 1);
-        tw32(HOSTCC_TXMAX_FRAMES, LOW_RXMAX_FRAMES);
-        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
-                tw32(HOSTCC_RXCOAL_TICK_INT, 0);
-                tw32(HOSTCC_TXCOAL_TICK_INT, 0);
-        }
-        tw32(HOSTCC_RXCOAL_MAXF_INT, 1);
-        tw32(HOSTCC_TXCOAL_MAXF_INT, 0);
+        tg3_set_coalesce(tp, &tp->coal);
 
         /* set status block DMA address */
         tw32(HOSTCC_STATUS_BLK_HOST_ADDR + TG3_64BIT_REG_HIGH,
@@ -5395,8 +5448,6 @@ static int tg3_reset_hw(struct tg3 *tp)
                  * the tg3_periodic_fetch_stats call there, and
                  * tg3_get_stats to see how this works for 5705/5750 chips.
                  */
-                tw32(HOSTCC_STAT_COAL_TICKS,
-                     DEFAULT_STAT_COAL_TICKS);
                 tw32(HOSTCC_STATS_BLK_HOST_ADDR + TG3_64BIT_REG_HIGH,
                      ((u64) tp->stats_mapping >> 32));
                 tw32(HOSTCC_STATS_BLK_HOST_ADDR + TG3_64BIT_REG_LOW,
@@ -5452,7 +5503,8 @@ static int tg3_reset_hw(struct tg3 *tp)
         udelay(100);
 
         tw32_mailbox(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW, 0);
-        tr32(MAILBOX_INTERRUPT_0);
+        tr32(MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW);
+        tp->last_tag = 0;
 
         if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS)) {
                 tw32_f(DMAC_MODE, DMAC_MODE_ENABLE);
@@ -5730,31 +5782,33 @@ static void tg3_timer(unsigned long __opaque)
         spin_lock_irqsave(&tp->lock, flags);
         spin_lock(&tp->tx_lock);
 
-        /* All of this garbage is because when using non-tagged
-         * IRQ status the mailbox/status_block protocol the chip
-         * uses with the cpu is race prone.
-         */
-        if (tp->hw_status->status & SD_STATUS_UPDATED) {
-                tw32(GRC_LOCAL_CTRL,
-                     tp->grc_local_ctrl | GRC_LCLCTRL_SETINT);
-        } else {
-                tw32(HOSTCC_MODE, tp->coalesce_mode |
-                     (HOSTCC_MODE_ENABLE | HOSTCC_MODE_NOW));
-        }
+        if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)) {
+                /* All of this garbage is because when using non-tagged
+                 * IRQ status the mailbox/status_block protocol the chip
+                 * uses with the cpu is race prone.
+                 */
+                if (tp->hw_status->status & SD_STATUS_UPDATED) {
+                        tw32(GRC_LOCAL_CTRL,
+                             tp->grc_local_ctrl | GRC_LCLCTRL_SETINT);
+                } else {
+                        tw32(HOSTCC_MODE, tp->coalesce_mode |
+                             (HOSTCC_MODE_ENABLE | HOSTCC_MODE_NOW));
+                }
 
-        if (!(tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
-                tp->tg3_flags2 |= TG3_FLG2_RESTART_TIMER;
-                spin_unlock(&tp->tx_lock);
-                spin_unlock_irqrestore(&tp->lock, flags);
-                schedule_work(&tp->reset_task);
-                return;
+                if (!(tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
+                        tp->tg3_flags2 |= TG3_FLG2_RESTART_TIMER;
+                        spin_unlock(&tp->tx_lock);
+                        spin_unlock_irqrestore(&tp->lock, flags);
+                        schedule_work(&tp->reset_task);
+                        return;
+                }
         }
 
-        if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS)
-                tg3_periodic_fetch_stats(tp);
-
         /* This part only runs once per second. */
         if (!--tp->timer_counter) {
+                if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS)
+                        tg3_periodic_fetch_stats(tp);
+
                 if (tp->tg3_flags & TG3_FLAG_USE_LINKCHG_REG) {
                         u32 mac_stat;
                         int phy_event;
@@ -5853,9 +5907,13 @@ static int tg3_test_interrupt(struct tg3 *tp)
         if (tp->tg3_flags2 & TG3_FLG2_USING_MSI)
                 err = request_irq(tp->pdev->irq, tg3_msi,
                                   SA_SAMPLE_RANDOM, dev->name, dev);
-        else
-                err = request_irq(tp->pdev->irq, tg3_interrupt,
+        else {
+                irqreturn_t (*fn)(int, void *, struct pt_regs *)=tg3_interrupt;
+                if (tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)
+                        fn = tg3_interrupt_tagged;
+                err = request_irq(tp->pdev->irq, fn,
                                   SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
+        }
 
         if (err)
                 return err;
@@ -5907,9 +5965,14 @@ static int tg3_test_msi(struct tg3 *tp)
 
         tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
 
-        err = request_irq(tp->pdev->irq, tg3_interrupt,
-                          SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
+        {
+                irqreturn_t (*fn)(int, void *, struct pt_regs *)=tg3_interrupt;
+                if (tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)
+                        fn = tg3_interrupt_tagged;
 
+                err = request_irq(tp->pdev->irq, fn,
+                                  SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
+        }
         if (err)
                 return err;
 
@@ -5919,7 +5982,7 @@ static int tg3_test_msi(struct tg3 *tp)
         spin_lock_irq(&tp->lock);
         spin_lock(&tp->tx_lock);
 
-        tg3_halt(tp);
+        tg3_halt(tp, 1);
         err = tg3_init_hw(tp);
 
         spin_unlock(&tp->tx_lock);
@@ -5955,7 +6018,13 @@ static int tg3_open(struct net_device *dev)
         if ((tp->tg3_flags2 & TG3_FLG2_5750_PLUS) &&
             (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5750_AX) &&
             (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5750_BX)) {
-                if (pci_enable_msi(tp->pdev) == 0) {
+                /* All MSI supporting chips should support tagged
+                 * status.  Assert that this is the case.
+                 */
+                if (!(tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)) {
+                        printk(KERN_WARNING PFX "%s: MSI without TAGGED? "
+                               "Not using MSI.\n", tp->dev->name);
+                } else if (pci_enable_msi(tp->pdev) == 0) {
                         u32 msi_mode;
 
                         msi_mode = tr32(MSGINT_MODE);
@@ -5966,9 +6035,14 @@ static int tg3_open(struct net_device *dev)
         if (tp->tg3_flags2 & TG3_FLG2_USING_MSI)
                 err = request_irq(tp->pdev->irq, tg3_msi,
                                   SA_SAMPLE_RANDOM, dev->name, dev);
-        else
-                err = request_irq(tp->pdev->irq, tg3_interrupt,
+        else {
+                irqreturn_t (*fn)(int, void *, struct pt_regs *)=tg3_interrupt;
+                if (tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)
+                        fn = tg3_interrupt_tagged;
+
+                err = request_irq(tp->pdev->irq, fn,
                                   SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
+        }
 
         if (err) {
                 if (tp->tg3_flags2 & TG3_FLG2_USING_MSI) {
@@ -5984,12 +6058,19 @@ static int tg3_open(struct net_device *dev)
 
         err = tg3_init_hw(tp);
         if (err) {
-                tg3_halt(tp);
+                tg3_halt(tp, 1);
                 tg3_free_rings(tp);
         } else {
-                tp->timer_offset = HZ / 10;
-                tp->timer_counter = tp->timer_multiplier = 10;
-                tp->asf_counter = tp->asf_multiplier = (10 * 120);
+                if (tp->tg3_flags & TG3_FLAG_TAGGED_STATUS)
+                        tp->timer_offset = HZ;
+                else
+                        tp->timer_offset = HZ / 10;
+
+                BUG_ON(tp->timer_offset > HZ);
+                tp->timer_counter = tp->timer_multiplier =
+                        (HZ / tp->timer_offset);
+                tp->asf_counter = tp->asf_multiplier =
+                        ((HZ / tp->timer_offset) * 120);
 
                 init_timer(&tp->timer);
                 tp->timer.expires = jiffies + tp->timer_offset;
@@ -6012,6 +6093,7 @@ static int tg3_open(struct net_device *dev)
 
         if (tp->tg3_flags2 & TG3_FLG2_USING_MSI) {
                 err = tg3_test_msi(tp);
+
                 if (err) {
                         spin_lock_irq(&tp->lock);
                         spin_lock(&tp->tx_lock);
@@ -6020,7 +6102,7 @@ static int tg3_open(struct net_device *dev)
                                 pci_disable_msi(tp->pdev);
                                 tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
                         }
-                        tg3_halt(tp);
+                        tg3_halt(tp, 1);
                         tg3_free_rings(tp);
                         tg3_free_consistent(tp);
 
@@ -6293,7 +6375,7 @@ static int tg3_close(struct net_device *dev)
 
         tg3_disable_ints(tp);
 
-        tg3_halt(tp);
+        tg3_halt(tp, 1);
         tg3_free_rings(tp);
         tp->tg3_flags &=
                 ~(TG3_FLAG_INIT_COMPLETE |
@@ -7013,7 +7095,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
         tp->tx_pending = ering->tx_pending;
 
         if (netif_running(dev)) {
-                tg3_halt(tp);
+                tg3_halt(tp, 1);
                 tg3_init_hw(tp);
                 tg3_netif_start(tp);
         }
@@ -7056,7 +7138,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
                 tp->tg3_flags &= ~TG3_FLAG_TX_PAUSE;
 
         if (netif_running(dev)) {
-                tg3_halt(tp);
+                tg3_halt(tp, 1);
                 tg3_init_hw(tp);
                 tg3_netif_start(tp);
         }
@@ -7210,6 +7292,14 @@ static void tg3_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
 }
 #endif
 
+static int tg3_get_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
+{
+        struct tg3 *tp = netdev_priv(dev);
+
+        memcpy(ec, &tp->coal, sizeof(*ec));
+        return 0;
+}
+
 static struct ethtool_ops tg3_ethtool_ops = {
         .get_settings           = tg3_get_settings,
         .set_settings           = tg3_set_settings,
@@ -7242,6 +7332,7 @@ static struct ethtool_ops tg3_ethtool_ops = {
         .get_strings            = tg3_get_strings,
         .get_stats_count        = tg3_get_stats_count,
         .get_ethtool_stats      = tg3_get_ethtool_stats,
+        .get_coalesce           = tg3_get_coalesce,
 };
 
 static void __devinit tg3_get_eeprom_size(struct tg3 *tp)
@@ -8429,15 +8520,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS)
                 tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
 
-        /* Only 5701 and later support tagged irq status mode.
-         * Also, 5788 chips cannot use tagged irq status.
-         *
-         * However, since we are using NAPI avoid tagged irq status
-         * because the interrupt condition is more difficult to
-         * fully clear in that mode.
-         */
         tp->coalesce_mode = 0;
-
         if (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5700_AX &&
             GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5700_BX)
                 tp->coalesce_mode |= HOSTCC_MODE_32BYTE;
@@ -8501,6 +8584,18 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
              grc_misc_cfg == GRC_MISC_CFG_BOARD_ID_5788M))
                 tp->tg3_flags2 |= TG3_FLG2_IS_5788;
 
+        if (!(tp->tg3_flags2 & TG3_FLG2_IS_5788) &&
+            (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700))
+                tp->tg3_flags |= TG3_FLAG_TAGGED_STATUS;
+        if (tp->tg3_flags & TG3_FLAG_TAGGED_STATUS) {
+                tp->coalesce_mode |= (HOSTCC_MODE_CLRTICK_RXBD |
+                                      HOSTCC_MODE_CLRTICK_TXBD);
+
+                tp->misc_host_ctrl |= MISC_HOST_CTRL_TAGGED_STATUS;
+                pci_write_config_dword(tp->pdev, TG3PCI_MISC_HOST_CTRL,
+                                       tp->misc_host_ctrl);
+        }
+
         /* these are limited to 10/100 only */
         if ((GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5703 &&
              (grc_misc_cfg == 0x8000 || grc_misc_cfg == 0x4000)) ||
@@ -8678,6 +8773,146 @@ static int __devinit tg3_get_device_address(struct tg3 *tp)
         return 0;
 }
 
+#define BOUNDARY_SINGLE_CACHELINE       1
+#define BOUNDARY_MULTI_CACHELINE        2
+
+static u32 __devinit tg3_calc_dma_bndry(struct tg3 *tp, u32 val)
+{
+        int cacheline_size;
+        u8 byte;
+        int goal;
+
+        pci_read_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE, &byte);
+        if (byte == 0)
+                cacheline_size = 1024;
+        else
+                cacheline_size = (int) byte * 4;
+
+        /* On 5703 and later chips, the boundary bits have no
+         * effect.
+         */
+        if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700 &&
+            GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701 &&
+            !(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS))
+                goto out;
+
+#if defined(CONFIG_PPC64) || defined(CONFIG_IA64) || defined(CONFIG_PARISC)
+        goal = BOUNDARY_MULTI_CACHELINE;
+#else
+#if defined(CONFIG_SPARC64) || defined(CONFIG_ALPHA)
+        goal = BOUNDARY_SINGLE_CACHELINE;
+#else
+        goal = 0;
+#endif
+#endif
+
+        if (!goal)
+                goto out;
+
+        /* PCI controllers on most RISC systems tend to disconnect
+         * when a device tries to burst across a cache-line boundary.
+         * Therefore, letting tg3 do so just wastes PCI bandwidth.
+         *
+         * Unfortunately, for PCI-E there are only limited
+         * write-side controls for this, and thus for reads
+         * we will still get the disconnects.  We'll also waste
+         * these PCI cycles for both read and write for chips
+         * other than 5700 and 5701 which do not implement the
+         * boundary bits.
+         */
+        if ((tp->tg3_flags & TG3_FLAG_PCIX_MODE) &&
+            !(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)) {
+                switch (cacheline_size) {
+                case 16:
+                case 32:
+                case 64:
+                case 128:
+                        if (goal == BOUNDARY_SINGLE_CACHELINE) {
+                                val |= (DMA_RWCTRL_READ_BNDRY_128_PCIX |
+                                        DMA_RWCTRL_WRITE_BNDRY_128_PCIX);
+                        } else {
+                                val |= (DMA_RWCTRL_READ_BNDRY_384_PCIX |
+                                        DMA_RWCTRL_WRITE_BNDRY_384_PCIX);
+                        }
+                        break;
+
+                case 256:
+                        val |= (DMA_RWCTRL_READ_BNDRY_256_PCIX |
+                                DMA_RWCTRL_WRITE_BNDRY_256_PCIX);
+                        break;
+
+                default:
+                        val |= (DMA_RWCTRL_READ_BNDRY_384_PCIX |
+                                DMA_RWCTRL_WRITE_BNDRY_384_PCIX);
+                        break;
+                };
+        } else if (tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS) {
+                switch (cacheline_size) {
+                case 16:
+                case 32:
+                case 64:
+                        if (goal == BOUNDARY_SINGLE_CACHELINE) {
+                                val &= ~DMA_RWCTRL_WRITE_BNDRY_DISAB_PCIE;
+                                val |= DMA_RWCTRL_WRITE_BNDRY_64_PCIE;
+                                break;
+                        }
+                        /* fallthrough */
+                case 128:
+                default:
+                        val &= ~DMA_RWCTRL_WRITE_BNDRY_DISAB_PCIE;
+                        val |= DMA_RWCTRL_WRITE_BNDRY_128_PCIE;
+                        break;
+                };
+        } else {
+                switch (cacheline_size) {
+                case 16:
+                        if (goal == BOUNDARY_SINGLE_CACHELINE) {
+                                val |= (DMA_RWCTRL_READ_BNDRY_16 |
+                                        DMA_RWCTRL_WRITE_BNDRY_16);
+                                break;
+                        }
+                        /* fallthrough */
+                case 32:
+                        if (goal == BOUNDARY_SINGLE_CACHELINE) {
+                                val |= (DMA_RWCTRL_READ_BNDRY_32 |
+                                        DMA_RWCTRL_WRITE_BNDRY_32);
+                                break;
+                        }
+                        /* fallthrough */
+                case 64:
+                        if (goal == BOUNDARY_SINGLE_CACHELINE) {
+                                val |= (DMA_RWCTRL_READ_BNDRY_64 |
+                                        DMA_RWCTRL_WRITE_BNDRY_64);
+                                break;
+                        }
+                        /* fallthrough */
+                case 128:
+                        if (goal == BOUNDARY_SINGLE_CACHELINE) {
+                                val |= (DMA_RWCTRL_READ_BNDRY_128 |
+                                        DMA_RWCTRL_WRITE_BNDRY_128);
+                                break;
+                        }
+                        /* fallthrough */
+                case 256:
+                        val |= (DMA_RWCTRL_READ_BNDRY_256 |
+                                DMA_RWCTRL_WRITE_BNDRY_256);
+                        break;
+                case 512:
+                        val |= (DMA_RWCTRL_READ_BNDRY_512 |
+                                DMA_RWCTRL_WRITE_BNDRY_512);
+                        break;
+                case 1024:
+                default:
+                        val |= (DMA_RWCTRL_READ_BNDRY_1024 |
+                                DMA_RWCTRL_WRITE_BNDRY_1024);
+                        break;
+                };
+        }
+
+out:
+        return val;
+}
+
 static int __devinit tg3_do_test_dma(struct tg3 *tp, u32 *buf, dma_addr_t buf_dma, int size, int to_device)
 {
         struct tg3_internal_buffer_desc test_desc;
@@ -8764,7 +8999,7 @@ static int __devinit tg3_do_test_dma(struct tg3 *tp, u32 *buf, dma_addr_t buf_dm
 static int __devinit tg3_test_dma(struct tg3 *tp)
 {
         dma_addr_t buf_dma;
-        u32 *buf;
+        u32 *buf, saved_dma_rwctrl;
         int ret;
 
         buf = pci_alloc_consistent(tp->pdev, TEST_BUFFER_SIZE, &buf_dma);
@@ -8776,46 +9011,7 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
         tp->dma_rwctrl = ((0x7 << DMA_RWCTRL_PCI_WRITE_CMD_SHIFT) |
                           (0x6 << DMA_RWCTRL_PCI_READ_CMD_SHIFT));
 
-#ifndef CONFIG_X86
-        {
-                u8 byte;
-                int cacheline_size;
-                pci_read_config_byte(tp->pdev, PCI_CACHE_LINE_SIZE, &byte);
-
-                if (byte == 0)
-                        cacheline_size = 1024;
-                else
-                        cacheline_size = (int) byte * 4;
-
-                switch (cacheline_size) {
-                case 16:
-                case 32:
-                case 64:
-                case 128:
-                        if ((tp->tg3_flags & TG3_FLAG_PCIX_MODE) &&
-                            !(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS)) {
-                                tp->dma_rwctrl |=
-                                        DMA_RWCTRL_WRITE_BNDRY_384_PCIX;
-                                break;
-                        } else if (tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS) {
-                                tp->dma_rwctrl &=
-                                        ~(DMA_RWCTRL_PCI_WRITE_CMD);
-                                tp->dma_rwctrl |=
-                                        DMA_RWCTRL_WRITE_BNDRY_128_PCIE;
-                                break;
-                        }
-                        /* fallthrough */
-                case 256:
-                        if (!(tp->tg3_flags & TG3_FLAG_PCIX_MODE) &&
-                            !(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS))
-                                tp->dma_rwctrl |=
-                                        DMA_RWCTRL_WRITE_BNDRY_256;
-                        else if (!(tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS))
-                                tp->dma_rwctrl |=
-                                        DMA_RWCTRL_WRITE_BNDRY_256_PCIX;
-                };
-        }
-#endif
+        tp->dma_rwctrl = tg3_calc_dma_bndry(tp, tp->dma_rwctrl);
 
         if (tp->tg3_flags2 & TG3_FLG2_PCI_EXPRESS) {
                 /* DMA read watermark not used on PCIE */
@@ -8834,7 +9030,7 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
                         if (ccval == 0x6 || ccval == 0x7)
                                 tp->dma_rwctrl |= DMA_RWCTRL_ONE_DMA;
 
-                        /* Set bit 23 to renable PCIX hw bug fix */
+                        /* Set bit 23 to enable PCIX hw bug fix */
                         tp->dma_rwctrl |= 0x009f0000;
                 } else {
                         tp->dma_rwctrl |= 0x001b000f;
@@ -8875,6 +9071,13 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
             GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701)
                 goto out;
 
+        /* It is best to perform DMA test with maximum write burst size
+         * to expose the 5700/5701 write DMA bug.
+         */
+        saved_dma_rwctrl = tp->dma_rwctrl;
+        tp->dma_rwctrl &= ~DMA_RWCTRL_WRITE_BNDRY_MASK;
+        tw32(TG3PCI_DMA_RW_CTRL, tp->dma_rwctrl);
+
         while (1) {
                 u32 *p = buf, i;
 
@@ -8913,8 +9116,9 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
                         if (p[i] == i)
                                 continue;
 
-                        if ((tp->dma_rwctrl & DMA_RWCTRL_WRITE_BNDRY_MASK) ==
-                            DMA_RWCTRL_WRITE_BNDRY_DISAB) {
+                        if ((tp->dma_rwctrl & DMA_RWCTRL_WRITE_BNDRY_MASK) !=
+                            DMA_RWCTRL_WRITE_BNDRY_16) {
+                                tp->dma_rwctrl &= ~DMA_RWCTRL_WRITE_BNDRY_MASK;
                                 tp->dma_rwctrl |= DMA_RWCTRL_WRITE_BNDRY_16;
                                 tw32(TG3PCI_DMA_RW_CTRL, tp->dma_rwctrl);
                                 break;
@@ -8931,6 +9135,14 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
                         break;
                 }
         }
+        if ((tp->dma_rwctrl & DMA_RWCTRL_WRITE_BNDRY_MASK) !=
+            DMA_RWCTRL_WRITE_BNDRY_16) {
+                /* DMA test passed without adjusting DMA boundary,
+                 * just restore the calculated DMA boundary
+                 */
+                tp->dma_rwctrl = saved_dma_rwctrl;
+                tw32(TG3PCI_DMA_RW_CTRL, tp->dma_rwctrl);
+        }
 
 out:
         pci_free_consistent(tp->pdev, TEST_BUFFER_SIZE, buf, buf_dma);
@@ -9018,6 +9230,31 @@ static struct pci_dev * __devinit tg3_find_5704_peer(struct tg3 *tp)
         return peer;
 }
 
+static void __devinit tg3_init_coal(struct tg3 *tp)
+{
+        struct ethtool_coalesce *ec = &tp->coal;
+
+        memset(ec, 0, sizeof(*ec));
+        ec->cmd = ETHTOOL_GCOALESCE;
+        ec->rx_coalesce_usecs = LOW_RXCOL_TICKS;
+        ec->tx_coalesce_usecs = LOW_TXCOL_TICKS;
+        ec->rx_max_coalesced_frames = LOW_RXMAX_FRAMES;
+        ec->tx_max_coalesced_frames = LOW_TXMAX_FRAMES;
+        ec->rx_coalesce_usecs_irq = DEFAULT_RXCOAL_TICK_INT;
+        ec->tx_coalesce_usecs_irq = DEFAULT_TXCOAL_TICK_INT;
+        ec->rx_max_coalesced_frames_irq = DEFAULT_RXCOAL_MAXF_INT;
+        ec->tx_max_coalesced_frames_irq = DEFAULT_TXCOAL_MAXF_INT;
+        ec->stats_block_coalesce_usecs = DEFAULT_STAT_COAL_TICKS;
+
+        if (tp->coalesce_mode & (HOSTCC_MODE_CLRTICK_RXBD |
+                                 HOSTCC_MODE_CLRTICK_TXBD)) {
+                ec->rx_coalesce_usecs = LOW_RXCOL_TICKS_CLRTCKS;
+                ec->rx_coalesce_usecs_irq = DEFAULT_RXCOAL_TICK_INT_CLRTCKS;
+                ec->tx_coalesce_usecs = LOW_TXCOL_TICKS_CLRTCKS;
+                ec->tx_coalesce_usecs_irq = DEFAULT_TXCOAL_TICK_INT_CLRTCKS;
+        }
+}
+
 static int __devinit tg3_init_one(struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
@@ -9239,7 +9476,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
             (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
                 pci_save_state(tp->pdev);
                 tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
-                tg3_halt(tp);
+                tg3_halt(tp, 1);
         }
 
         err = tg3_test_dma(tp);
@@ -9263,6 +9500,8 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         /* flow control autonegotiation is default behavior */
         tp->tg3_flags |= TG3_FLAG_PAUSE_AUTONEG;
 
+        tg3_init_coal(tp);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR PFX "Cannot register net device, "
@@ -9305,6 +9544,8 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                (tp->tg3_flags & TG3_FLAG_SPLIT_MODE) != 0,
                (tp->tg3_flags2 & TG3_FLG2_NO_ETH_WIRE_SPEED) == 0,
                (tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE) != 0);
+        printk(KERN_INFO "%s: dma_rwctrl[%08x]\n",
+               dev->name, tp->dma_rwctrl);
 
         return 0;
 
@@ -9362,7 +9603,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
 
         spin_lock_irq(&tp->lock);
         spin_lock(&tp->tx_lock);
-        tg3_halt(tp);
+        tg3_halt(tp, 1);
         spin_unlock(&tp->tx_lock);
         spin_unlock_irq(&tp->lock);
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 8de6f21037ba..993f84c93dc4 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -876,10 +876,12 @@
 #define  HOSTCC_STATUS_ERROR_ATTN        0x00000004
 #define HOSTCC_RXCOL_TICKS              0x00003c08
 #define  LOW_RXCOL_TICKS                 0x00000032
+#define  LOW_RXCOL_TICKS_CLRTCKS         0x00000014
 #define  DEFAULT_RXCOL_TICKS             0x00000048
 #define  HIGH_RXCOL_TICKS                0x00000096
 #define HOSTCC_TXCOL_TICKS              0x00003c0c
 #define  LOW_TXCOL_TICKS                 0x00000096
+#define  LOW_TXCOL_TICKS_CLRTCKS         0x00000048
 #define  DEFAULT_TXCOL_TICKS             0x0000012c
 #define  HIGH_TXCOL_TICKS                0x00000145
 #define HOSTCC_RXMAX_FRAMES             0x00003c10
@@ -892,8 +894,10 @@
 #define  HIGH_TXMAX_FRAMES               0x00000052
 #define HOSTCC_RXCOAL_TICK_INT          0x00003c18
 #define  DEFAULT_RXCOAL_TICK_INT         0x00000019
+#define  DEFAULT_RXCOAL_TICK_INT_CLRTCKS 0x00000014
 #define HOSTCC_TXCOAL_TICK_INT          0x00003c1c
 #define  DEFAULT_TXCOAL_TICK_INT         0x00000019
+#define  DEFAULT_TXCOAL_TICK_INT_CLRTCKS 0x00000014
 #define HOSTCC_RXCOAL_MAXF_INT          0x00003c20
 #define  DEFAULT_RXCOAL_MAXF_INT         0x00000005
 #define HOSTCC_TXCOAL_MAXF_INT          0x00003c24
@@ -2023,6 +2027,7 @@ struct tg3 {
 
         struct tg3_hw_status            *hw_status;
         dma_addr_t                      status_mapping;
+        u32                             last_tag;
 
         u32                             msg_enable;
 
@@ -2068,6 +2073,7 @@ struct tg3 {
 
         u32                             rx_offset;
         u32                             tg3_flags;
+#define TG3_FLAG_TAGGED_STATUS          0x00000001
 #define TG3_FLAG_TXD_MBOX_HWBUG         0x00000002
 #define TG3_FLAG_RX_CHECKSUMS           0x00000004
 #define TG3_FLAG_USE_LINKCHG_REG        0x00000008
@@ -2225,7 +2231,7 @@ struct tg3 {
 
 #define SST_25VF0X0_PAGE_SIZE           4098
 
-
+        struct ethtool_coalesce         coal;
 };
 
 #endif /* !(_T3_H) */
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index d098b3ba3538..e0ae3ed6e578 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -1104,7 +1104,7 @@ static void set_rx_mode(struct net_device *dev)
                         if (entry != 0) {
                                 /* Avoid a chip errata by prefixing a dummy entry. Don't do
                                    this on the ULI526X as it triggers a different problem */
-                                if (!(tp->chip_id == ULI526X && (tp->revision = 0x40 || tp->revision == 0x50))) {
+                                if (!(tp->chip_id == ULI526X && (tp->revision == 0x40 || tp->revision == 0x50))) {
                                         tp->tx_buffers[entry].skb = NULL;
                                         tp->tx_buffers[entry].mapping = 0;
                                         tp->tx_ring[entry].length =
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 0aaa12c0c098..1d3231cc471a 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -323,7 +323,7 @@ config PRISM54
           For a complete list of supported cards visit <http://prism54.org>.
           Here is the latest confirmed list of supported cards:
 
-          3com OfficeConnect 11g Cardbus Card aka 3CRWE154G72
+          3com OfficeConnect 11g Cardbus Card aka 3CRWE154G72 (version 1)
           Allnet ALL0271 PCI Card
           Compex WL54G Cardbus Card
           Corega CG-WLCB54GT Cardbus Card
diff --git a/drivers/pci/hotplug.c b/drivers/pci/hotplug.c
index 021d0f76bc4c..3903f8c559b6 100644
--- a/drivers/pci/hotplug.c
+++ b/drivers/pci/hotplug.c
@@ -52,116 +52,17 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
         if ((buffer_size - length <= 0) || (i >= num_envp))
                 return -ENOMEM;
 
+        envp[i++] = scratch;
+        length += scnprintf (scratch, buffer_size - length,
+                            "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x\n",
+                            pdev->vendor, pdev->device,
+                            pdev->subsystem_vendor, pdev->subsystem_device,
+                            (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
+                            (u8)(pdev->class));
+        if ((buffer_size - length <= 0) || (i >= num_envp))
+                return -ENOMEM;
+
         envp[i] = NULL;
 
         return 0;
 }
-
-static int pci_visit_bus (struct pci_visit * fn, struct pci_bus_wrapped *wrapped_bus, struct pci_dev_wrapped *wrapped_parent)
-{
-        struct list_head *ln;
-        struct pci_dev *dev;
-        struct pci_dev_wrapped wrapped_dev;
-        int result = 0;
-
-        pr_debug("PCI: Scanning bus %04x:%02x\n", pci_domain_nr(wrapped_bus->bus),
-                wrapped_bus->bus->number);
-
-        if (fn->pre_visit_pci_bus) {
-                result = fn->pre_visit_pci_bus(wrapped_bus, wrapped_parent);
-                if (result)
-                        return result;
-        }
-
-        ln = wrapped_bus->bus->devices.next; 
-        while (ln != &wrapped_bus->bus->devices) {
-                dev = pci_dev_b(ln);
-                ln = ln->next;
-
-                memset(&wrapped_dev, 0, sizeof(struct pci_dev_wrapped));
-                wrapped_dev.dev = dev;
-
-                result = pci_visit_dev(fn, &wrapped_dev, wrapped_bus);
-                if (result)
-                        return result;
-        }
-
-        if (fn->post_visit_pci_bus)
-                result = fn->post_visit_pci_bus(wrapped_bus, wrapped_parent);
-
-        return result;
-}
-
-static int pci_visit_bridge (struct pci_visit * fn,
-                             struct pci_dev_wrapped *wrapped_dev,
-                             struct pci_bus_wrapped *wrapped_parent)
-{
-        struct pci_bus *bus;
-        struct pci_bus_wrapped wrapped_bus;
-        int result = 0;
-
-        pr_debug("PCI: Scanning bridge %s\n", pci_name(wrapped_dev->dev));
-
-        if (fn->visit_pci_dev) {
-                result = fn->visit_pci_dev(wrapped_dev, wrapped_parent);
-                if (result)
-                        return result;
-        }
-
-        bus = wrapped_dev->dev->subordinate;
-        if (bus) {
-                memset(&wrapped_bus, 0, sizeof(struct pci_bus_wrapped));
-                wrapped_bus.bus = bus;
-
-                result = pci_visit_bus(fn, &wrapped_bus, wrapped_dev);
-        }
-        return result;
-}
-
-/**
- * pci_visit_dev - scans the pci buses.
- * @fn: callback functions that are called while visiting
- * @wrapped_dev: the device to scan
- * @wrapped_parent: the bus where @wrapped_dev is connected to
- *
- * Every bus and every function is presented to a custom
- * function that can act upon it.
- */
-int pci_visit_dev(struct pci_visit *fn, struct pci_dev_wrapped *wrapped_dev,
-                  struct pci_bus_wrapped *wrapped_parent)
-{
-        struct pci_dev* dev = wrapped_dev ? wrapped_dev->dev : NULL;
-        int result = 0;
-
-        if (!dev)
-                return 0;
-
-        if (fn->pre_visit_pci_dev) {
-                result = fn->pre_visit_pci_dev(wrapped_dev, wrapped_parent);
-                if (result)
-                        return result;
-        }
-
-        switch (dev->class >> 8) {
-                case PCI_CLASS_BRIDGE_PCI:
-                        result = pci_visit_bridge(fn, wrapped_dev,
-                                                  wrapped_parent);
-                        if (result)
-                                return result;
-                        break;
-                default:
-                        pr_debug("PCI: Scanning device %s\n", pci_name(dev));
-                        if (fn->visit_pci_dev) {
-                                result = fn->visit_pci_dev (wrapped_dev,
-                                                            wrapped_parent);
-                                if (result)
-                                        return result;
-                        }
-        }
-
-        if (fn->post_visit_pci_dev)
-                result = fn->post_visit_pci_dev(wrapped_dev, wrapped_parent);
-
-        return result;
-}
-EXPORT_SYMBOL(pci_visit_dev);
diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
index 3ddd75937a40..d9769b30be9a 100644
--- a/drivers/pci/hotplug/cpci_hotplug.h
+++ b/drivers/pci/hotplug/cpci_hotplug.h
@@ -31,7 +31,7 @@
 #include <linux/types.h>
 #include <linux/pci.h>
 
-/* PICMG 2.12 R2.0 HS CSR bits: */
+/* PICMG 2.1 R2.0 HS CSR bits: */
 #define HS_CSR_INS      0x0080
 #define HS_CSR_EXT      0x0040
 #define HS_CSR_PI       0x0030
diff --git a/drivers/pci/hotplug/cpci_hotplug_core.c b/drivers/pci/hotplug/cpci_hotplug_core.c
index ed243605dc7b..9e9dab7fe86a 100644
--- a/drivers/pci/hotplug/cpci_hotplug_core.c
+++ b/drivers/pci/hotplug/cpci_hotplug_core.c
@@ -33,11 +33,11 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/smp_lock.h>
+#include <asm/atomic.h>
 #include <linux/delay.h>
 #include "pci_hotplug.h"
 #include "cpci_hotplug.h"
 
-#define DRIVER_VERSION  "0.2"
 #define DRIVER_AUTHOR   "Scott Murray <scottm@somanetworks.com>"
 #define DRIVER_DESC     "CompactPCI Hot Plug Core"
 
@@ -54,9 +54,10 @@
 #define warn(format, arg...) printk(KERN_WARNING "%s: " format "\n", MY_NAME , ## arg)
 
 /* local variables */
-static spinlock_t list_lock;
+static DECLARE_RWSEM(list_rwsem);
 static LIST_HEAD(slot_list);
 static int slots;
+static atomic_t extracting;
 int cpci_debug;
 static struct cpci_hp_controller *controller;
 static struct semaphore event_semaphore;        /* mutex for process loop (up if something to process) */
@@ -68,6 +69,8 @@ static int disable_slot(struct hotplug_slot *slot);
 static int set_attention_status(struct hotplug_slot *slot, u8 value);
 static int get_power_status(struct hotplug_slot *slot, u8 * value);
 static int get_attention_status(struct hotplug_slot *slot, u8 * value);
+static int get_adapter_status(struct hotplug_slot *slot, u8 * value);
+static int get_latch_status(struct hotplug_slot *slot, u8 * value);
 
 static struct hotplug_slot_ops cpci_hotplug_slot_ops = {
         .owner = THIS_MODULE,
@@ -76,6 +79,8 @@ static struct hotplug_slot_ops cpci_hotplug_slot_ops = {
         .set_attention_status = set_attention_status,
         .get_power_status = get_power_status,
         .get_attention_status = get_attention_status,
+        .get_adapter_status = get_adapter_status,
+        .get_latch_status = get_latch_status,
 };
 
 static int
@@ -148,8 +153,10 @@ disable_slot(struct hotplug_slot *hotplug_slot)
                 warn("failure to update adapter file");
         }
 
-        slot->extracting = 0;
-
+        if(slot->extracting) {
+                slot->extracting = 0;
+                atomic_dec(&extracting);
+        }
         return retval;
 }
 
@@ -188,6 +195,20 @@ set_attention_status(struct hotplug_slot *hotplug_slot, u8 status)
         return cpci_set_attention_status(hotplug_slot->private, status);
 }
 
+static int
+get_adapter_status(struct hotplug_slot *hotplug_slot, u8 * value)
+{
+        *value = hotplug_slot->info->adapter_status;
+        return 0;
+}
+
+static int
+get_latch_status(struct hotplug_slot *hotplug_slot, u8 * value)
+{
+        *value = hotplug_slot->info->latch_status;
+        return 0;
+}
+
 static void release_slot(struct hotplug_slot *hotplug_slot)
 {
         struct slot *slot = hotplug_slot->private;
@@ -273,10 +294,10 @@ cpci_hp_register_bus(struct pci_bus *bus, u8 first, u8 last)
                 }
 
                 /* Add slot to our internal list */
-                spin_lock(&list_lock);
+                down_write(&list_rwsem);
                 list_add(&slot->slot_list, &slot_list);
                 slots++;
-                spin_unlock(&list_lock);
+                up_write(&list_rwsem);
         }
         return 0;
 error_name:
@@ -299,9 +320,9 @@ cpci_hp_unregister_bus(struct pci_bus *bus)
         struct list_head *next;
         int status;
 
-        spin_lock(&list_lock);
+        down_write(&list_rwsem);
         if(!slots) {
-                spin_unlock(&list_lock);
+                up_write(&list_rwsem);
                 return -1;
         }
         list_for_each_safe(tmp, next, &slot_list) {
@@ -319,7 +340,7 @@ cpci_hp_unregister_bus(struct pci_bus *bus)
                         slots--;
                 }
         }
-        spin_unlock(&list_lock);
+        up_write(&list_rwsem);
         return 0;
 }
 
@@ -347,7 +368,7 @@ cpci_hp_intr(int irq, void *data, struct pt_regs *regs)
 }
 
 /*
- * According to PICMG 2.12 R2.0, section 6.3.2, upon
+ * According to PICMG 2.1 R2.0, section 6.3.2, upon
  * initialization, the system driver shall clear the
  * INS bits of the cold-inserted devices.
  */
@@ -359,9 +380,9 @@ init_slots(void)
         struct pci_dev* dev;
 
         dbg("%s - enter", __FUNCTION__);
-        spin_lock(&list_lock);
+        down_read(&list_rwsem);
         if(!slots) {
-                spin_unlock(&list_lock);
+                up_read(&list_rwsem);
                 return -1;
         }
         list_for_each(tmp, &slot_list) {
@@ -386,7 +407,7 @@ init_slots(void)
                         }
                 }
         }
-        spin_unlock(&list_lock);
+        up_read(&list_rwsem);
         dbg("%s - exit", __FUNCTION__);
         return 0;
 }
@@ -398,10 +419,11 @@ check_slots(void)
         struct list_head *tmp;
         int extracted;
         int inserted;
+        u16 hs_csr;
 
-        spin_lock(&list_lock);
+        down_read(&list_rwsem);
         if(!slots) {
-                spin_unlock(&list_lock);
+                up_read(&list_rwsem);
                 err("no slots registered, shutting down");
                 return -1;
         }
@@ -411,8 +433,6 @@ check_slots(void)
                 dbg("%s - looking at slot %s",
                     __FUNCTION__, slot->hotplug_slot->name);
                 if(cpci_check_and_clear_ins(slot)) {
-                        u16 hs_csr;
-
                         /* Some broken hardware (e.g. PLX 9054AB) asserts ENUM# twice... */
                         if(slot->dev) {
                                 warn("slot %s already inserted", slot->hotplug_slot->name);
@@ -462,8 +482,6 @@ check_slots(void)
 
                         inserted++;
                 } else if(cpci_check_ext(slot)) {
-                        u16 hs_csr;
-
                         /* Process extraction request */
                         dbg("%s - slot %s extracted",
                             __FUNCTION__, slot->hotplug_slot->name);
@@ -476,20 +494,40 @@ check_slots(void)
                         if(!slot->extracting) {
                                 if(update_latch_status(slot->hotplug_slot, 0)) {
                                         warn("failure to update latch file");
+
                                 }
+                                atomic_inc(&extracting);
                                 slot->extracting = 1;
                         }
                         extracted++;
+                } else if(slot->extracting) {
+                        hs_csr = cpci_get_hs_csr(slot);
+                        if(hs_csr == 0xffff) {
+                                /*
+                                 * Hmmm, we're likely hosed at this point, should we
+                                 * bother trying to tell the driver or not?
+                                 */
+                                err("card in slot %s was improperly removed",
+                                    slot->hotplug_slot->name);
+                                if(update_adapter_status(slot->hotplug_slot, 0)) {
+                                        warn("failure to update adapter file");
+                                }
+                                slot->extracting = 0;
+                                atomic_dec(&extracting);
+                        }
                 }
         }
-        spin_unlock(&list_lock);
+        up_read(&list_rwsem);
+        dbg("inserted=%d, extracted=%d, extracting=%d",
+            inserted, extracted, atomic_read(&extracting));
         if(inserted || extracted) {
                 return extracted;
         }
-        else {
+        else if(!atomic_read(&extracting)) {
                 err("cannot find ENUM# source, shutting down");
                 return -1;
         }
+        return 0;
 }
 
 /* This is the interrupt mode worker thread body */
@@ -497,8 +535,6 @@ static int
 event_thread(void *data)
 {
         int rc;
-        struct slot *slot;
-        struct list_head *tmp;
 
         lock_kernel();
         daemonize("cpci_hp_eventd");
@@ -512,39 +548,22 @@ event_thread(void *data)
                     thread_finished);
                 if(thread_finished || signal_pending(current))
                         break;
-                while(controller->ops->query_enum()) {
+                do {
                         rc = check_slots();
-                        if (rc > 0)
+                        if (rc > 0) {
                                 /* Give userspace a chance to handle extraction */
                                 msleep(500);
-                        else if (rc < 0) {
+                        } else if (rc < 0) {
                                 dbg("%s - error checking slots", __FUNCTION__);
                                 thread_finished = 1;
                                 break;
                         }
-                }
-                /* Check for someone yanking out a board */
-                list_for_each(tmp, &slot_list) {
-                        slot = list_entry(tmp, struct slot, slot_list);
-                        if(slot->extracting) {
-                                /*
-                                 * Hmmm, we're likely hosed at this point, should we
-                                 * bother trying to tell the driver or not?
-                                 */
-                                err("card in slot %s was improperly removed",
-                                    slot->hotplug_slot->name);
-                                if(update_adapter_status(slot->hotplug_slot, 0)) {
-                                        warn("failure to update adapter file");
-                                }
-                                slot->extracting = 0;
-                        }
-                }
+                } while(atomic_read(&extracting) != 0);
 
                 /* Re-enable ENUM# interrupt */
                 dbg("%s - re-enabling irq", __FUNCTION__);
                 controller->ops->enable_irq();
         }
-
         dbg("%s - event thread signals exit", __FUNCTION__);
         up(&thread_exit);
         return 0;
@@ -555,8 +574,6 @@ static int
 poll_thread(void *data)
 {
         int rc;
-        struct slot *slot;
-        struct list_head *tmp;
 
         lock_kernel();
         daemonize("cpci_hp_polld");
@@ -565,35 +582,19 @@ poll_thread(void *data)
         while(1) {
                 if(thread_finished || signal_pending(current))
                         break;
-
-                while(controller->ops->query_enum()) {
-                        rc = check_slots();
-                        if(rc > 0)
-                                /* Give userspace a chance to handle extraction */
-                                msleep(500);
-                        else if (rc < 0) {
-                                dbg("%s - error checking slots", __FUNCTION__);
-                                thread_finished = 1;
-                                break;
-                        }
-                }
-                /* Check for someone yanking out a board */
-                list_for_each(tmp, &slot_list) {
-                        slot = list_entry(tmp, struct slot, slot_list);
-                        if(slot->extracting) {
-                                /*
-                                 * Hmmm, we're likely hosed at this point, should we
-                                 * bother trying to tell the driver or not?
-                                 */
-                                err("card in slot %s was improperly removed",
-                                    slot->hotplug_slot->name);
-                                if(update_adapter_status(slot->hotplug_slot, 0)) {
-                                        warn("failure to update adapter file");
+                if(controller->ops->query_enum()) {
+                        do {
+                                rc = check_slots();
+                                if(rc > 0) {
+                                        /* Give userspace a chance to handle extraction */
+                                        msleep(500);
+                                } else if(rc < 0) {
+                                        dbg("%s - error checking slots", __FUNCTION__);
+                                        thread_finished = 1;
+                                        break;
                                 }
-                                slot->extracting = 0;
-                        }
+                        } while(atomic_read(&extracting) != 0);
                 }
-
                 msleep(100);
         }
         dbg("poll thread signals exit");
@@ -667,6 +668,9 @@ cpci_hp_unregister_controller(struct cpci_hp_controller *old_controller)
         int status = 0;
 
         if(controller) {
+                if(atomic_read(&extracting) != 0) {
+                        return -EBUSY;
+                }
                 if(!thread_finished) {
                         cpci_stop_thread();
                 }
@@ -691,12 +695,12 @@ cpci_hp_start(void)
                 return -ENODEV;
         }
 
-        spin_lock(&list_lock);
-        if(!slots) {
-                spin_unlock(&list_lock);
+        down_read(&list_rwsem);
+        if(list_empty(&slot_list)) {
+                up_read(&list_rwsem);
                 return -ENODEV;
         }
-        spin_unlock(&list_lock);
+        up_read(&list_rwsem);
 
         if(first) {
                 status = init_slots();
@@ -727,7 +731,9 @@ cpci_hp_stop(void)
         if(!controller) {
                 return -ENODEV;
         }
-
+        if(atomic_read(&extracting) != 0) {
+                return -EBUSY;
+        }
         if(controller->irq) {
                 /* Stop enum interrupt processing */
                 dbg("%s - disabling irq", __FUNCTION__);
@@ -747,7 +753,7 @@ cleanup_slots(void)
          * Unregister all of our slots with the pci_hotplug subsystem,
          * and free up all memory that we had allocated.
          */
-        spin_lock(&list_lock);
+        down_write(&list_rwsem);
         if(!slots) {
                 goto null_cleanup;
         }
@@ -761,17 +767,14 @@ cleanup_slots(void)
                 kfree(slot);
         }
       null_cleanup:
-        spin_unlock(&list_lock);
+        up_write(&list_rwsem);
         return;
 }
 
 int __init
 cpci_hotplug_init(int debug)
 {
-        spin_lock_init(&list_lock);
         cpci_debug = debug;
-
-        info(DRIVER_DESC " version: " DRIVER_VERSION);
         return 0;
 }
 
diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
index 2e969616f298..69eb4fc54f2f 100644
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -32,11 +32,7 @@
 #include "pci_hotplug.h"
 #include "cpci_hotplug.h"
 
-#if !defined(MODULE)
 #define MY_NAME "cpci_hotplug"
-#else
-#define MY_NAME THIS_MODULE->name
-#endif
 
 extern int cpci_debug;
 
@@ -127,38 +123,6 @@ u16 cpci_get_hs_csr(struct slot* slot)
         return hs_csr;
 }
 
-#if 0
-u16 cpci_set_hs_csr(struct slot* slot, u16 hs_csr)
-{
-        int hs_cap;
-        u16 new_hs_csr;
-
-        hs_cap = pci_bus_find_capability(slot->bus,
-                                         slot->devfn,
-                                         PCI_CAP_ID_CHSWP);
-        if(!hs_cap) {
-                return 0xFFFF;
-        }
-
-        /* Write out the new value */
-        if(pci_bus_write_config_word(slot->bus,
-                                      slot->devfn,
-                                      hs_cap + 2,
-                                      hs_csr)) {
-                return 0xFFFF;
-        }
-
-        /* Read back what we just wrote out */
-        if(pci_bus_read_config_word(slot->bus,
-                                     slot->devfn,
-                                     hs_cap + 2,
-                                     &new_hs_csr)) {
-                return 0xFFFF;
-        }
-        return new_hs_csr;
-}
-#endif
-
 int cpci_check_and_clear_ins(struct slot* slot)
 {
         int hs_cap;
@@ -261,7 +225,6 @@ int cpci_led_on(struct slot* slot)
                 return -ENODEV;
         }
         if((hs_csr & HS_CSR_LOO) != HS_CSR_LOO) {
-                /* Set LOO */
                 hs_csr |= HS_CSR_LOO;
                 if(pci_bus_write_config_word(slot->bus,
                                               slot->devfn,
@@ -293,7 +256,6 @@ int cpci_led_off(struct slot* slot)
                 return -ENODEV;
         }
         if(hs_csr & HS_CSR_LOO) {
-                /* Clear LOO */
                 hs_csr &= ~HS_CSR_LOO;
                 if(pci_bus_write_config_word(slot->bus,
                                               slot->devfn,
@@ -312,257 +274,23 @@ int cpci_led_off(struct slot* slot)
  * Device configuration functions
  */
 
-static int cpci_configure_dev(struct pci_bus *bus, struct pci_dev *dev)
-{
-        u8 irq_pin;
-        int r;
-
-        dbg("%s - enter", __FUNCTION__);
-
-        /* NOTE: device already setup from prior scan */
-
-        /* FIXME: How would we know if we need to enable the expansion ROM? */
-        pci_write_config_word(dev, PCI_ROM_ADDRESS, 0x00L);
-
-        /* Assign resources */
-        dbg("assigning resources for %02x:%02x.%x",
-            dev->bus->number, PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn));
-        for (r = 0; r < 6; r++) {
-                struct resource *res = dev->resource + r;
-                if(res->flags)
-                        pci_assign_resource(dev, r);
-        }
-        dbg("finished assigning resources for %02x:%02x.%x",
-            dev->bus->number, PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn));
-
-        /* Does this function have an interrupt at all? */
-        dbg("checking for function interrupt");
-        pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &irq_pin);
-        if(irq_pin) {
-                dbg("function uses interrupt pin %d", irq_pin);
-        }
-
-        /*
-         * Need to explicitly set irq field to 0 so that it'll get assigned
-         * by the pcibios platform dependent code called by pci_enable_device.
-         */
-        dev->irq = 0;
-
-        dbg("enabling device");
-        pci_enable_device(dev); /* XXX check return */
-        dbg("now dev->irq = %d", dev->irq);
-        if(irq_pin && dev->irq) {
-                pci_write_config_byte(dev, PCI_INTERRUPT_LINE, dev->irq);
-        }
-
-        /* Can't use pci_insert_device at the moment, do it manually for now */
-        pci_proc_attach_device(dev);
-        dbg("notifying drivers");
-        //pci_announce_device_to_drivers(dev);
-        dbg("%s - exit", __FUNCTION__);
-        return 0;
-}
-
-static int cpci_configure_bridge(struct pci_bus* bus, struct pci_dev* dev)
+static void cpci_enable_device(struct pci_dev *dev)
 {
-        int rc;
-        struct pci_bus* child;
-        struct resource* r;
-        u8 max, n;
-        u16 command;
-
-        dbg("%s - enter", __FUNCTION__);
+        struct pci_bus *bus;
 
-        /* Do basic bridge initialization */
-        rc = pci_write_config_byte(dev, PCI_LATENCY_TIMER, 0x40);
-        if(rc) {
-                printk(KERN_ERR "%s - write of PCI_LATENCY_TIMER failed\n", __FUNCTION__);
-        }
-        rc = pci_write_config_byte(dev, PCI_SEC_LATENCY_TIMER, 0x40);
-        if(rc) {
-                printk(KERN_ERR "%s - write of PCI_SEC_LATENCY_TIMER failed\n", __FUNCTION__);
-        }
-        rc = pci_write_config_byte(dev, PCI_CACHE_LINE_SIZE, L1_CACHE_BYTES / 4);
-        if(rc) {
-                printk(KERN_ERR "%s - write of PCI_CACHE_LINE_SIZE failed\n", __FUNCTION__);
-        }
-
-        /*
-         * Set parent bridge's subordinate field so that configuration space
-         * access will work in pci_scan_bridge and friends.
-         */
-        max = pci_max_busnr();
-        bus->subordinate = max + 1;
-        pci_write_config_byte(bus->self, PCI_SUBORDINATE_BUS, max + 1);
-
-        /* Scan behind bridge */
-        n = pci_scan_bridge(bus, dev, max, 2);
-        child = pci_find_bus(0, max + 1);
-        if (!child)
-                return -ENODEV;
-        pci_proc_attach_bus(child);
-
-        /*
-         * Update parent bridge's subordinate field if there were more bridges
-         * behind the bridge that was scanned.
-         */
-        if(n > max) {
-                bus->subordinate = n;
-                pci_write_config_byte(bus->self, PCI_SUBORDINATE_BUS, n);
-        }
-
-        /*
-         * Update the bridge resources of the bridge to accommodate devices
-         * behind it.
-         */
-        pci_bus_size_bridges(child);
-        pci_bus_assign_resources(child);
-
-        /* Enable resource mapping via command register */
-        command = PCI_COMMAND_MASTER | PCI_COMMAND_INVALIDATE | PCI_COMMAND_PARITY | PCI_COMMAND_SERR;
-        r = child->resource[0];
-        if(r && r->start) {
-                command |= PCI_COMMAND_IO;
-        }
-        r = child->resource[1];
-        if(r && r->start) {
-                command |= PCI_COMMAND_MEMORY;
-        }
-        r = child->resource[2];
-        if(r && r->start) {
-                command |= PCI_COMMAND_MEMORY;
-        }
-        rc = pci_write_config_word(dev, PCI_COMMAND, command);
-        if(rc) {
-                err("Error setting command register");
-                return rc;
-        }
-
-        /* Set bridge control register */
-        command = PCI_BRIDGE_CTL_PARITY | PCI_BRIDGE_CTL_SERR | PCI_BRIDGE_CTL_NO_ISA;
-        rc = pci_write_config_word(dev, PCI_BRIDGE_CONTROL, command);
-        if(rc) {
-                err("Error setting bridge control register");
-                return rc;
-        }
-        dbg("%s - exit", __FUNCTION__);
-        return 0;
-}
-
-static int configure_visit_pci_dev(struct pci_dev_wrapped *wrapped_dev,
-                                   struct pci_bus_wrapped *wrapped_bus)
-{
-        int rc;
-        struct pci_dev *dev = wrapped_dev->dev;
-        struct pci_bus *bus = wrapped_bus->bus;
-        struct slot* slot;
-
-        dbg("%s - enter", __FUNCTION__);
-
-        /*
-         * We need to fix up the hotplug representation with the Linux
-         * representation.
-         */
-        if(wrapped_dev->data) {
-                slot = (struct slot*) wrapped_dev->data;
-                slot->dev = dev;
-        }
-
-        /* If it's a bridge, scan behind it for devices */
+        pci_enable_device(dev);
         if(dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
-                rc = cpci_configure_bridge(bus, dev);
-                if(rc)
-                        return rc;
-        }
-
-        /* Actually configure device */
-        if(dev) {
-                rc = cpci_configure_dev(bus, dev);
-                if(rc)
-                        return rc;
-        }
-        dbg("%s - exit", __FUNCTION__);
-        return 0;
-}
-
-static int unconfigure_visit_pci_dev_phase2(struct pci_dev_wrapped *wrapped_dev,
-                                            struct pci_bus_wrapped *wrapped_bus)
-{
-        struct pci_dev *dev = wrapped_dev->dev;
-        struct slot* slot;
-
-        dbg("%s - enter", __FUNCTION__);
-        if(!dev)
-                return -ENODEV;
-
-        /* Remove the Linux representation */
-        if(pci_remove_device_safe(dev)) {
-                err("Could not remove device\n");
-                return -1;
-        }
-
-        /*
-         * Now remove the hotplug representation.
-         */
-        if(wrapped_dev->data) {
-                slot = (struct slot*) wrapped_dev->data;
-                slot->dev = NULL;
-        } else {
-                dbg("No hotplug representation for %02x:%02x.%x",
-                    dev->bus->number, PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn));
-        }
-        dbg("%s - exit", __FUNCTION__);
-        return 0;
-}
-
-static int unconfigure_visit_pci_bus_phase2(struct pci_bus_wrapped *wrapped_bus,
-                                            struct pci_dev_wrapped *wrapped_dev)
-{
-        struct pci_bus *bus = wrapped_bus->bus;
-        struct pci_bus *parent = bus->self->bus;
-
-        dbg("%s - enter", __FUNCTION__);
-
-        /* The cleanup code for proc entries regarding buses should be in the kernel... */
-        if(bus->procdir)
-                dbg("detach_pci_bus %s", bus->procdir->name);
-        pci_proc_detach_bus(bus);
-
-        /* The cleanup code should live in the kernel... */
-        bus->self->subordinate = NULL;
-
-        /* unlink from parent bus */
-        list_del(&bus->node);
-
-        /* Now, remove */
-        if(bus)
-                kfree(bus);
-
-        /* Update parent's subordinate field */
-        if(parent) {
-                u8 n = pci_bus_max_busnr(parent);
-                if(n < parent->subordinate) {
-                        parent->subordinate = n;
-                        pci_write_config_byte(parent->self, PCI_SUBORDINATE_BUS, n);
+                bus = dev->subordinate;
+                list_for_each_entry(dev, &bus->devices, bus_list) {
+                        cpci_enable_device(dev);
                 }
         }
-        dbg("%s - exit", __FUNCTION__);
-        return 0;
 }
 
-static struct pci_visit configure_functions = {
-        .visit_pci_dev = configure_visit_pci_dev,
-};
-
-static struct pci_visit unconfigure_functions_phase2 = {
-        .post_visit_pci_bus = unconfigure_visit_pci_bus_phase2,
-        .post_visit_pci_dev = unconfigure_visit_pci_dev_phase2
-};
-
-
 int cpci_configure_slot(struct slot* slot)
 {
-        int rc = 0;
+        unsigned char busnr;
+        struct pci_bus *child;
 
         dbg("%s - enter", __FUNCTION__);
 
@@ -588,74 +316,44 @@ int cpci_configure_slot(struct slot* slot)
                 slot->dev = pci_find_slot(slot->bus->number, slot->devfn);
                 if(slot->dev == NULL) {
                         err("Could not find PCI device for slot %02x", slot->number);
-                        return 0;
+                        return 1;
                 }
         }
-        dbg("slot->dev = %p", slot->dev);
-        if(slot->dev) {
-                struct pci_dev *dev;
-                struct pci_dev_wrapped wrapped_dev;
-                struct pci_bus_wrapped wrapped_bus;
-                int i;
-
-                memset(&wrapped_dev, 0, sizeof (struct pci_dev_wrapped));
-                memset(&wrapped_bus, 0, sizeof (struct pci_bus_wrapped));
-
-                for (i = 0; i < 8; i++) {
-                        dev = pci_find_slot(slot->bus->number,
-                                            PCI_DEVFN(PCI_SLOT(slot->dev->devfn), i));
-                        if(!dev)
-                                continue;
-                        wrapped_dev.dev = dev;
-                        wrapped_bus.bus = slot->dev->bus;
-                        if(i)
-                                wrapped_dev.data = NULL;
-                        else
-                                wrapped_dev.data = (void*) slot;
-                        rc = pci_visit_dev(&configure_functions, &wrapped_dev, &wrapped_bus);
-                }
+
+        if (slot->dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+                pci_read_config_byte(slot->dev, PCI_SECONDARY_BUS, &busnr);
+                child = pci_add_new_bus(slot->dev->bus, slot->dev, busnr);
+                pci_do_scan_bus(child);
+                pci_bus_size_bridges(child);
         }
 
-        dbg("%s - exit, rc = %d", __FUNCTION__, rc);
-        return rc;
+        pci_bus_assign_resources(slot->dev->bus);
+
+        cpci_enable_device(slot->dev);
+
+        dbg("%s - exit", __FUNCTION__);
+        return 0;
 }
 
 int cpci_unconfigure_slot(struct slot* slot)
 {
-        int rc = 0;
         int i;
-        struct pci_dev_wrapped wrapped_dev;
-        struct pci_bus_wrapped wrapped_bus;
         struct pci_dev *dev;
 
         dbg("%s - enter", __FUNCTION__);
-
         if(!slot->dev) {
                 err("No device for slot %02x\n", slot->number);
                 return -ENODEV;
         }
 
-        memset(&wrapped_dev, 0, sizeof (struct pci_dev_wrapped));
-        memset(&wrapped_bus, 0, sizeof (struct pci_bus_wrapped));
-
         for (i = 0; i < 8; i++) {
                 dev = pci_find_slot(slot->bus->number,
                                     PCI_DEVFN(PCI_SLOT(slot->devfn), i));
                 if(dev) {
-                        wrapped_dev.dev = dev;
-                        wrapped_bus.bus = dev->bus;
-                        if(i)
-                                wrapped_dev.data = NULL;
-                        else
-                                wrapped_dev.data = (void*) slot;
-                        dbg("%s - unconfigure phase 2", __FUNCTION__);
-                        rc = pci_visit_dev(&unconfigure_functions_phase2,
-                                           &wrapped_dev,
-                                           &wrapped_bus);
-                        if(rc)
-                                break;
+                        pci_remove_bus_device(dev);
+                        slot->dev = NULL;
                 }
         }
-        dbg("%s - exit, rc = %d", __FUNCTION__, rc);
-        return rc;
+        dbg("%s - exit", __FUNCTION__);
+        return 0;
 }
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index f313121d5141..46b294a12418 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -130,6 +130,7 @@ struct controller {
         u8 slot_bus;            /* Bus where the slots handled by this controller sit */
         u8 ctrlcap;
         u16 vendor_id;
+        u8 cap_base;
 };
 
 struct irq_mapping {
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index ed1fd8d6178d..df4915dbc321 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -607,7 +607,7 @@ static int pciehp_resume (struct pcie_device *dev)
 static struct pcie_port_service_id port_pci_ids[] = { { 
         .vendor = PCI_ANY_ID, 
         .device = PCI_ANY_ID,
-        .port_type = PCIE_RC_PORT, 
+        .port_type = PCIE_ANY_PORT,
         .service_type = PCIE_PORT_SERVICE_HP,
         .driver_data =  0, 
         }, { /* end: all zeroes */ }
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 9e70c4681f77..1cda30bd6e47 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -109,20 +109,20 @@ enum ctrl_offsets {
 };
 static int pcie_cap_base = 0;           /* Base of the PCI Express capability item structure */ 
 
-#define PCIE_CAP_ID     ( pcie_cap_base + PCIECAPID )
-#define NXT_CAP_PTR     ( pcie_cap_base + NXTCAPPTR )
-#define CAP_REG         ( pcie_cap_base + CAPREG )
-#define DEV_CAP         ( pcie_cap_base + DEVCAP )
-#define DEV_CTRL        ( pcie_cap_base + DEVCTRL )
-#define DEV_STATUS      ( pcie_cap_base + DEVSTATUS )
-#define LNK_CAP         ( pcie_cap_base + LNKCAP )
-#define LNK_CTRL        ( pcie_cap_base + LNKCTRL )
-#define LNK_STATUS      ( pcie_cap_base + LNKSTATUS )
-#define SLOT_CAP        ( pcie_cap_base + SLOTCAP )
-#define SLOT_CTRL       ( pcie_cap_base + SLOTCTRL )
-#define SLOT_STATUS     ( pcie_cap_base + SLOTSTATUS )
-#define ROOT_CTRL       ( pcie_cap_base + ROOTCTRL )
-#define ROOT_STATUS     ( pcie_cap_base + ROOTSTATUS )
+#define PCIE_CAP_ID(cb) ( cb + PCIECAPID )
+#define NXT_CAP_PTR(cb) ( cb + NXTCAPPTR )
+#define CAP_REG(cb)     ( cb + CAPREG )
+#define DEV_CAP(cb)     ( cb + DEVCAP )
+#define DEV_CTRL(cb)    ( cb + DEVCTRL )
+#define DEV_STATUS(cb)  ( cb + DEVSTATUS )
+#define LNK_CAP(cb)     ( cb + LNKCAP )
+#define LNK_CTRL(cb)    ( cb + LNKCTRL )
+#define LNK_STATUS(cb)  ( cb + LNKSTATUS )
+#define SLOT_CAP(cb)    ( cb + SLOTCAP )
+#define SLOT_CTRL(cb)   ( cb + SLOTCTRL )
+#define SLOT_STATUS(cb) ( cb + SLOTSTATUS )
+#define ROOT_CTRL(cb)   ( cb + ROOTCTRL )
+#define ROOT_STATUS(cb) ( cb + ROOTSTATUS )
 
 #define hp_register_read_word(pdev, reg , value)                \
         pci_read_config_word(pdev, reg, &value)
@@ -303,7 +303,7 @@ static int pcie_write_cmd(struct slot *slot, u16 cmd)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(slot->ctrl->cap_base), slot_status);
         if (retval) {
                         err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                         return retval;
@@ -317,7 +317,7 @@ static int pcie_write_cmd(struct slot *slot, u16 cmd)
         }
 
         dbg("%s: Before hp_register_write_word SLOT_CTRL %x\n", __FUNCTION__, cmd);
-        retval = hp_register_write_word(php_ctlr->pci_dev, SLOT_CTRL, cmd | CMD_CMPL_INTR_ENABLE);
+        retval = hp_register_write_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), cmd | CMD_CMPL_INTR_ENABLE);
         if (retval) {
                 err("%s : hp_register_write_word SLOT_CTRL failed\n", __FUNCTION__);
                 return retval;
@@ -342,7 +342,7 @@ static int hpc_check_lnk_status(struct controller *ctrl)
                 return -1;
         }
         
-        retval = hp_register_read_word(php_ctlr->pci_dev, LNK_STATUS, lnk_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, LNK_STATUS(ctrl->cap_base), lnk_status);
 
         if (retval) {
                 err("%s : hp_register_read_word LNK_STATUS failed\n", __FUNCTION__);
@@ -376,14 +376,14 @@ static int hpc_get_attention_status(struct slot *slot, u8 *status)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 return retval;
         }
 
-        dbg("%s: SLOT_CTRL %x, value read %x\n", __FUNCTION__,SLOT_CTRL, slot_ctrl);
+        dbg("%s: SLOT_CTRL %x, value read %x\n", __FUNCTION__,SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         atten_led_state = (slot_ctrl & ATTN_LED_CTRL) >> 6;
 
@@ -423,13 +423,13 @@ static int hpc_get_power_status(struct slot * slot, u8 *status)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 return retval;
         }
-        dbg("%s: SLOT_CTRL %x value read %x\n", __FUNCTION__, SLOT_CTRL, slot_ctrl);
+        dbg("%s: SLOT_CTRL %x value read %x\n", __FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         pwr_state = (slot_ctrl & PWR_CTRL) >> 10;
 
@@ -463,7 +463,7 @@ static int hpc_get_latch_status(struct slot *slot, u8 *status)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(slot->ctrl->cap_base), slot_status);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
@@ -490,7 +490,7 @@ static int hpc_get_adapter_status(struct slot *slot, u8 *status)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(slot->ctrl->cap_base), slot_status);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
@@ -518,7 +518,7 @@ static int hpc_query_power_fault(struct slot * slot)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(slot->ctrl->cap_base), slot_status);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
@@ -549,7 +549,7 @@ static int hpc_set_attention_status(struct slot *slot, u8 value)
                 err("%s: Invalid HPC slot number!\n", __FUNCTION__);
                 return -1;
         }
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
@@ -574,7 +574,7 @@ static int hpc_set_attention_status(struct slot *slot, u8 value)
                 slot_cmd = slot_cmd | HP_INTR_ENABLE; 
 
         pcie_write_cmd(slot, slot_cmd);
-        dbg("%s: SLOT_CTRL %x write cmd %x\n", __FUNCTION__, SLOT_CTRL, slot_cmd);
+        dbg("%s: SLOT_CTRL %x write cmd %x\n", __FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_cmd);
         
         return rc;
 }
@@ -598,7 +598,7 @@ static void hpc_set_green_led_on(struct slot *slot)
                 return ;
         }
 
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
@@ -611,7 +611,7 @@ static void hpc_set_green_led_on(struct slot *slot)
 
         pcie_write_cmd(slot, slot_cmd);
 
-        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL, slot_cmd);
+        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_cmd);
         return;
 }
 
@@ -633,7 +633,7 @@ static void hpc_set_green_led_off(struct slot *slot)
                 return ;
         }
 
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
@@ -646,7 +646,7 @@ static void hpc_set_green_led_off(struct slot *slot)
         if (!pciehp_poll_mode)
                 slot_cmd = slot_cmd | HP_INTR_ENABLE; 
         pcie_write_cmd(slot, slot_cmd);
-        dbg("%s: SLOT_CTRL %x write cmd %x\n", __FUNCTION__, SLOT_CTRL, slot_cmd);
+        dbg("%s: SLOT_CTRL %x write cmd %x\n", __FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_cmd);
 
         return;
 }
@@ -669,7 +669,7 @@ static void hpc_set_green_led_blink(struct slot *slot)
                 return ;
         }
 
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
@@ -683,7 +683,7 @@ static void hpc_set_green_led_blink(struct slot *slot)
                 slot_cmd = slot_cmd | HP_INTR_ENABLE; 
         pcie_write_cmd(slot, slot_cmd);
 
-        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL, slot_cmd);
+        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_cmd);
         return;
 }
 
@@ -707,7 +707,7 @@ int pcie_get_ctlr_slot_config(struct controller *ctrl,
         *first_device_num = 0;
         *num_ctlr_slots = 1; 
 
-        rc = hp_register_read_dword(php_ctlr->pci_dev, SLOT_CAP, slot_cap);
+        rc = hp_register_read_dword(php_ctlr->pci_dev, SLOT_CAP(ctrl->cap_base), slot_cap);
 
         if (rc) {
                 err("%s : hp_register_read_dword SLOT_CAP failed\n", __FUNCTION__);
@@ -793,13 +793,13 @@ static int hpc_power_on_slot(struct slot * slot)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 return retval;
         }
-        dbg("%s: SLOT_CTRL %x, value read %xn", __FUNCTION__, SLOT_CTRL, 
+        dbg("%s: SLOT_CTRL %x, value read %xn", __FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base),
                 slot_ctrl);
 
         slot_cmd = (slot_ctrl & ~PWR_CTRL) | POWER_ON;
@@ -813,7 +813,7 @@ static int hpc_power_on_slot(struct slot * slot)
                 err("%s: Write %x command failed!\n", __FUNCTION__, slot_cmd);
                 return -1;
         }
-        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL, slot_cmd);
+        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_cmd);
 
         DBG_LEAVE_ROUTINE
 
@@ -842,13 +842,13 @@ static int hpc_power_off_slot(struct slot * slot)
                 err("%s: Invalid HPC slot number!\n", __FUNCTION__);
                 return -1;
         }
-        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        retval = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(slot->ctrl->cap_base), slot_ctrl);
 
         if (retval) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 return retval;
         }
-        dbg("%s: SLOT_CTRL %x, value read %x\n", __FUNCTION__, SLOT_CTRL, 
+        dbg("%s: SLOT_CTRL %x, value read %x\n", __FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base),
                 slot_ctrl);
 
         slot_cmd = (slot_ctrl & ~PWR_CTRL) | POWER_OFF;
@@ -862,7 +862,7 @@ static int hpc_power_off_slot(struct slot * slot)
                 err("%s: Write command failed!\n", __FUNCTION__);
                 return -1;
         }
-        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL, slot_cmd);
+        dbg("%s: SLOT_CTRL %x write cmd %x\n",__FUNCTION__, SLOT_CTRL(slot->ctrl->cap_base), slot_cmd);
 
         DBG_LEAVE_ROUTINE
 
@@ -900,7 +900,7 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
                 return IRQ_NONE;
         }
 
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), slot_status);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                 return IRQ_NONE;
@@ -918,7 +918,7 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
         dbg("%s: intr_loc %x\n", __FUNCTION__, intr_loc);
         /* Mask Hot-plug Interrupt Enable */
         if (!pciehp_poll_mode) {
-                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, temp_word);
+                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(ctrl->cap_base), temp_word);
                 if (rc) {
                         err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                         return IRQ_NONE;
@@ -928,14 +928,14 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
                 dbg("%s: hp_register_read_word SLOT_CTRL with value %x\n", __FUNCTION__, temp_word);
                 temp_word = (temp_word & ~HP_INTR_ENABLE & ~CMD_CMPL_INTR_ENABLE) | 0x00;
 
-                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_CTRL, temp_word);
+                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_CTRL(ctrl->cap_base), temp_word);
                 if (rc) {
                         err("%s : hp_register_write_word SLOT_CTRL failed\n", __FUNCTION__);
                         return IRQ_NONE;
                 }
                 dbg("%s: hp_register_write_word SLOT_CTRL with value %x\n", __FUNCTION__, temp_word);
                 
-                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), slot_status);
                 if (rc) {
                         err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                         return IRQ_NONE;
@@ -944,7 +944,7 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
                 
                 /* Clear command complete interrupt caused by this write */
                 temp_word = 0x1f;
-                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS, temp_word);
+                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), temp_word);
                 if (rc) {
                         err("%s : hp_register_write_word SLOT_STATUS failed\n", __FUNCTION__);
                         return IRQ_NONE;
@@ -975,14 +975,14 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
 
         /* Clear all events after serving them */
         temp_word = 0x1F;
-        rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS, temp_word);
+        rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_write_word SLOT_STATUS failed\n", __FUNCTION__);
                 return IRQ_NONE;
         }
         /* Unmask Hot-plug Interrupt Enable */
         if (!pciehp_poll_mode) {
-                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, temp_word);
+                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(ctrl->cap_base), temp_word);
                 if (rc) {
                         err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                         return IRQ_NONE;
@@ -992,14 +992,14 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
                 dbg("%s: hp_register_read_word SLOT_CTRL with value %x\n", __FUNCTION__, temp_word);
                 temp_word = (temp_word & ~HP_INTR_ENABLE) | HP_INTR_ENABLE;
 
-                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_CTRL, temp_word);
+                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_CTRL(ctrl->cap_base), temp_word);
                 if (rc) {
                         err("%s : hp_register_write_word SLOT_CTRL failed\n", __FUNCTION__);
                         return IRQ_NONE;
                 }
                 dbg("%s: hp_register_write_word SLOT_CTRL with value %x\n", __FUNCTION__, temp_word);   
         
-                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+                rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), slot_status);
                 if (rc) {
                         err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                         return IRQ_NONE;
@@ -1008,7 +1008,7 @@ static irqreturn_t pcie_isr(int IRQ, void *dev_id, struct pt_regs *regs)
                 
                 /* Clear command complete interrupt caused by this write */
                 temp_word = 0x1F;
-                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS, temp_word);
+                rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), temp_word);
                 if (rc) {
                         err("%s : hp_register_write_word SLOT_STATUS failed\n", __FUNCTION__);
                         return IRQ_NONE;
@@ -1038,7 +1038,7 @@ static int hpc_get_max_lnk_speed (struct slot *slot, enum pci_bus_speed *value)
                 return -1;
         }
 
-        retval = hp_register_read_dword(php_ctlr->pci_dev, LNK_CAP, lnk_cap);
+        retval = hp_register_read_dword(php_ctlr->pci_dev, LNK_CAP(slot->ctrl->cap_base), lnk_cap);
 
         if (retval) {
                 err("%s : hp_register_read_dword  LNK_CAP failed\n", __FUNCTION__);
@@ -1079,7 +1079,7 @@ static int hpc_get_max_lnk_width (struct slot *slot, enum pcie_link_width *value
                 return -1;
         }
 
-        retval = hp_register_read_dword(php_ctlr->pci_dev, LNK_CAP, lnk_cap);
+        retval = hp_register_read_dword(php_ctlr->pci_dev, LNK_CAP(slot->ctrl->cap_base), lnk_cap);
 
         if (retval) {
                 err("%s : hp_register_read_dword  LNK_CAP failed\n", __FUNCTION__);
@@ -1141,7 +1141,7 @@ static int hpc_get_cur_lnk_speed (struct slot *slot, enum pci_bus_speed *value)
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, LNK_STATUS, lnk_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, LNK_STATUS(slot->ctrl->cap_base), lnk_status);
 
         if (retval) {
                 err("%s : hp_register_read_word LNK_STATUS failed\n", __FUNCTION__);
@@ -1182,7 +1182,7 @@ static int hpc_get_cur_lnk_width (struct slot *slot, enum pcie_link_width *value
                 return -1;
         }
 
-        retval = hp_register_read_word(php_ctlr->pci_dev, LNK_STATUS, lnk_status);
+        retval = hp_register_read_word(php_ctlr->pci_dev, LNK_STATUS(slot->ctrl->cap_base), lnk_status);
 
         if (retval) {
                 err("%s : hp_register_read_word LNK_STATUS failed\n", __FUNCTION__);
@@ -1292,47 +1292,48 @@ int pcie_init(struct controller * ctrl,
                 goto abort_free_ctlr;
         }
 
-        pcie_cap_base = cap_base;
+        ctrl->cap_base = cap_base;
 
         dbg("%s: pcie_cap_base %x\n", __FUNCTION__, pcie_cap_base);
 
-        rc = hp_register_read_word(pdev, CAP_REG, cap_reg);
+        rc = hp_register_read_word(pdev, CAP_REG(ctrl->cap_base), cap_reg);
         if (rc) {
                 err("%s : hp_register_read_word CAP_REG failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: CAP_REG offset %x cap_reg %x\n", __FUNCTION__, CAP_REG, cap_reg);
+        dbg("%s: CAP_REG offset %x cap_reg %x\n", __FUNCTION__, CAP_REG(ctrl->cap_base), cap_reg);
 
-        if (((cap_reg & SLOT_IMPL) == 0) || ((cap_reg & DEV_PORT_TYPE) != 0x0040)){
+        if (((cap_reg & SLOT_IMPL) == 0) || (((cap_reg & DEV_PORT_TYPE) != 0x0040)
+                && ((cap_reg & DEV_PORT_TYPE) != 0x0060))) {
                 dbg("%s : This is not a root port or the port is not connected to a slot\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
 
-        rc = hp_register_read_dword(php_ctlr->pci_dev, SLOT_CAP, slot_cap);
+        rc = hp_register_read_dword(php_ctlr->pci_dev, SLOT_CAP(ctrl->cap_base), slot_cap);
         if (rc) {
                 err("%s : hp_register_read_word CAP_REG failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: SLOT_CAP offset %x slot_cap %x\n", __FUNCTION__, SLOT_CAP, slot_cap);
+        dbg("%s: SLOT_CAP offset %x slot_cap %x\n", __FUNCTION__, SLOT_CAP(ctrl->cap_base), slot_cap);
 
         if (!(slot_cap & HP_CAP)) {
                 dbg("%s : This slot is not hot-plug capable\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
         /* For debugging purpose */
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), slot_status);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: SLOT_STATUS offset %x slot_status %x\n", __FUNCTION__, SLOT_STATUS, slot_status);
+        dbg("%s: SLOT_STATUS offset %x slot_status %x\n", __FUNCTION__, SLOT_STATUS(ctrl->cap_base), slot_status);
 
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL, slot_ctrl);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_CTRL(ctrl->cap_base), slot_ctrl);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: SLOT_CTRL offset %x slot_ctrl %x\n", __FUNCTION__, SLOT_CTRL, slot_ctrl);
+        dbg("%s: SLOT_CTRL offset %x slot_ctrl %x\n", __FUNCTION__, SLOT_CTRL(ctrl->cap_base), slot_ctrl);
 
         if (first) {
                 spin_lock_init(&hpc_event_lock);
@@ -1372,36 +1373,37 @@ int pcie_init(struct controller * ctrl,
         php_ctlr->num_slots = 1;
 
         /* Mask Hot-plug Interrupt Enable */
-        rc = hp_register_read_word(pdev, SLOT_CTRL, temp_word);
+        rc = hp_register_read_word(pdev, SLOT_CTRL(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
 
-        dbg("%s: SLOT_CTRL %x value read %x\n", __FUNCTION__, SLOT_CTRL, temp_word);
+        dbg("%s: SLOT_CTRL %x value read %x\n", __FUNCTION__, SLOT_CTRL(ctrl->cap_base), temp_word);
         temp_word = (temp_word & ~HP_INTR_ENABLE & ~CMD_CMPL_INTR_ENABLE) | 0x00;
 
-        rc = hp_register_write_word(pdev, SLOT_CTRL, temp_word);
+        rc = hp_register_write_word(pdev, SLOT_CTRL(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_write_word SLOT_CTRL failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
         dbg("%s : Mask HPIE hp_register_write_word SLOT_CTRL %x\n", __FUNCTION__, temp_word);
 
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), slot_status);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: Mask HPIE SLOT_STATUS offset %x reads slot_status %x\n", __FUNCTION__, SLOT_STATUS, slot_status);
+        dbg("%s: Mask HPIE SLOT_STATUS offset %x reads slot_status %x\n", __FUNCTION__, SLOT_STATUS(ctrl->cap_base)
+                , slot_status);
 
         temp_word = 0x1F; /* Clear all events */
-        rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS, temp_word);
+        rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_write_word SLOT_STATUS failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: SLOT_STATUS offset %x writes slot_status %x\n", __FUNCTION__, SLOT_STATUS, temp_word);
+        dbg("%s: SLOT_STATUS offset %x writes slot_status %x\n", __FUNCTION__, SLOT_STATUS(ctrl->cap_base), temp_word);
 
         if (pciehp_poll_mode)  {/* Install interrupt polling code */
                 /* Install and start the interrupt polling timer */
@@ -1417,12 +1419,12 @@ int pcie_init(struct controller * ctrl,
                 }
         }
 
-        rc = hp_register_read_word(pdev, SLOT_CTRL, temp_word);
+        rc = hp_register_read_word(pdev, SLOT_CTRL(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_CTRL failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: SLOT_CTRL %x value read %x\n", __FUNCTION__, SLOT_CTRL, temp_word);
+        dbg("%s: SLOT_CTRL %x value read %x\n", __FUNCTION__, SLOT_CTRL(ctrl->cap_base), temp_word);
         dbg("%s: slot_cap %x\n", __FUNCTION__, slot_cap);
 
         intr_enable = intr_enable | PRSN_DETECT_ENABLE;
@@ -1446,27 +1448,27 @@ int pcie_init(struct controller * ctrl,
         dbg("%s: temp_word %x\n", __FUNCTION__, temp_word);
 
         /* Unmask Hot-plug Interrupt Enable for the interrupt notification mechanism case */
-        rc = hp_register_write_word(pdev, SLOT_CTRL, temp_word);
+        rc = hp_register_write_word(pdev, SLOT_CTRL(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_write_word SLOT_CTRL failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
         dbg("%s : Unmask HPIE hp_register_write_word SLOT_CTRL with %x\n", __FUNCTION__, temp_word);
-        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS, slot_status);
+        rc = hp_register_read_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), slot_status);
         if (rc) {
                 err("%s : hp_register_read_word SLOT_STATUS failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
         dbg("%s: Unmask HPIE SLOT_STATUS offset %x reads slot_status %x\n", __FUNCTION__, 
-                SLOT_STATUS, slot_status);
+                SLOT_STATUS(ctrl->cap_base), slot_status);
         
         temp_word =  0x1F; /* Clear all events */
-        rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS, temp_word);
+        rc = hp_register_write_word(php_ctlr->pci_dev, SLOT_STATUS(ctrl->cap_base), temp_word);
         if (rc) {
                 err("%s : hp_register_write_word SLOT_STATUS failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
         }
-        dbg("%s: SLOT_STATUS offset %x writes slot_status %x\n", __FUNCTION__, SLOT_STATUS, temp_word);
+        dbg("%s: SLOT_STATUS offset %x writes slot_status %x\n", __FUNCTION__, SLOT_STATUS(ctrl->cap_base), temp_word);
         
         /*  Add this HPC instance into the HPC list */
         spin_lock(&list_lock);
diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
index f0c53f850aed..a70a5c5705f2 100644
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -95,7 +95,7 @@ static struct hotplug_slot_ops shpchp_hotplug_slot_ops = {
  */
 static void release_slot(struct hotplug_slot *hotplug_slot)
 {
-        struct slot *slot = (struct slot *)hotplug_slot->private;
+        struct slot *slot = hotplug_slot->private;
 
         dbg("%s - physical_slot = %s\n", __FUNCTION__, hotplug_slot->name);
 
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index 9f90eb8e6ecd..490a9553a062 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -1885,7 +1885,7 @@ int shpchp_enable_slot (struct slot *p_slot)
         func = shpchp_slot_find(p_slot->bus, p_slot->device, 0);
         if (!func) {
                 dbg("%s: Error! slot NULL\n", __FUNCTION__);
-                return 1;
+                return -ENODEV;
         }
 
         /* Check to see if (latch closed, card present, power off) */
@@ -1894,19 +1894,19 @@ int shpchp_enable_slot (struct slot *p_slot)
         if (rc || !getstatus) {
                 info("%s: no adapter on slot(%x)\n", __FUNCTION__, p_slot->number);
                 up(&p_slot->ctrl->crit_sect);
-                return 1;
+                return -ENODEV;
         }
         rc = p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
         if (rc || getstatus) {
                 info("%s: latch open on slot(%x)\n", __FUNCTION__, p_slot->number);
                 up(&p_slot->ctrl->crit_sect);
-                return 1;
+                return -ENODEV;
         }
         rc = p_slot->hpc_ops->get_power_status(p_slot, &getstatus);
         if (rc || getstatus) {
                 info("%s: already enabled on slot(%x)\n", __FUNCTION__, p_slot->number);
                 up(&p_slot->ctrl->crit_sect);
-                return 1;
+                return -ENODEV;
         }
         up(&p_slot->ctrl->crit_sect);
 
@@ -1914,7 +1914,7 @@ int shpchp_enable_slot (struct slot *p_slot)
 
         func = shpchp_slot_create(p_slot->bus);
         if (func == NULL)
-                return 1;
+                return -ENOMEM;
 
         func->bus = p_slot->bus;
         func->device = p_slot->device;
@@ -1939,7 +1939,7 @@ int shpchp_enable_slot (struct slot *p_slot)
                 /* Setup slot structure with entry for empty slot */
                 func = shpchp_slot_create(p_slot->bus);
                 if (func == NULL)
-                        return (1);     /* Out of memory */
+                        return -ENOMEM; /* Out of memory */
 
                 func->bus = p_slot->bus;
                 func->device = p_slot->device;
@@ -1972,7 +1972,7 @@ int shpchp_disable_slot (struct slot *p_slot)
         struct pci_func *func;
 
         if (!p_slot->ctrl)
-                return 1;
+                return -ENODEV;
 
         pci_bus = p_slot->ctrl->pci_dev->subordinate;
 
@@ -1983,19 +1983,19 @@ int shpchp_disable_slot (struct slot *p_slot)
         if (ret || !getstatus) {
                 info("%s: no adapter on slot(%x)\n", __FUNCTION__, p_slot->number);
                 up(&p_slot->ctrl->crit_sect);
-                return 1;
+                return -ENODEV;
         }
         ret = p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
         if (ret || getstatus) {
                 info("%s: latch open on slot(%x)\n", __FUNCTION__, p_slot->number);
                 up(&p_slot->ctrl->crit_sect);
-                return 1;
+                return -ENODEV;
         }
         ret = p_slot->hpc_ops->get_power_status(p_slot, &getstatus);
         if (ret || !getstatus) {
                 info("%s: already disabled slot(%x)\n", __FUNCTION__, p_slot->number);
                 up(&p_slot->ctrl->crit_sect);
-                return 1;
+                return -ENODEV;
         }
         up(&p_slot->ctrl->crit_sect);
 
@@ -2011,7 +2011,7 @@ int shpchp_disable_slot (struct slot *p_slot)
                 /* Check the Class Code */
                 rc = pci_bus_read_config_byte (pci_bus, devfn, 0x0B, &class_code);
                 if (rc)
-                        return rc;
+                        return -ENODEV;
 
                 if (class_code == PCI_BASE_CLASS_DISPLAY) {
                         /* Display/Video adapter (not supported) */
@@ -2020,13 +2020,13 @@ int shpchp_disable_slot (struct slot *p_slot)
                         /* See if it's a bridge */
                         rc = pci_bus_read_config_byte (pci_bus, devfn, PCI_HEADER_TYPE, &header_type);
                         if (rc)
-                                return rc;
+                                return -ENODEV;
 
                         /* If it's a bridge, check the VGA Enable bit */
                         if ((header_type & 0x7F) == PCI_HEADER_TYPE_BRIDGE) {
                                 rc = pci_bus_read_config_byte (pci_bus, devfn, PCI_BRIDGE_CONTROL, &BCR);
                                 if (rc)
-                                        return rc;
+                                        return -ENODEV;
 
                                 /* If the VGA Enable bit is set, remove isn't supported */
                                 if (BCR & PCI_BRIDGE_CTL_VGA) {
@@ -2042,12 +2042,12 @@ int shpchp_disable_slot (struct slot *p_slot)
         if ((func != NULL) && !rc) {
                 rc = remove_board(func, p_slot->ctrl);
         } else if (!rc)
-                rc = 1;
+                rc = -ENODEV;
 
         if (p_slot)
                 update_slot_info(p_slot);
 
-        return(rc);
+        return rc;
 }
 
 
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 8568b207f189..6ca0061137a6 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -73,6 +73,17 @@ resource_show(struct device * dev, char * buf)
         return (str - buf);
 }
 
+static ssize_t modalias_show(struct device *dev, char *buf)
+{
+        struct pci_dev *pci_dev = to_pci_dev(dev);
+
+        return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x\n",
+                       pci_dev->vendor, pci_dev->device,
+                       pci_dev->subsystem_vendor, pci_dev->subsystem_device,
+                       (u8)(pci_dev->class >> 16), (u8)(pci_dev->class >> 8),
+                       (u8)(pci_dev->class));
+}
+
 struct device_attribute pci_dev_attrs[] = {
         __ATTR_RO(resource),
         __ATTR_RO(vendor),
@@ -82,6 +93,7 @@ struct device_attribute pci_dev_attrs[] = {
         __ATTR_RO(class),
         __ATTR_RO(irq),
         __ATTR_RO(local_cpus),
+        __ATTR_RO(modalias),
         __ATTR_NULL,
 };
 
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 79cdc16c52c8..744da0d4ae5f 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -32,33 +32,6 @@ extern unsigned char pci_max_busnr(void);
 extern unsigned char pci_bus_max_busnr(struct pci_bus *bus);
 extern int pci_bus_find_capability (struct pci_bus *bus, unsigned int devfn, int cap);
 
-struct pci_dev_wrapped {
-        struct pci_dev  *dev;
-        void            *data;
-};
-
-struct pci_bus_wrapped {
-        struct pci_bus  *bus;
-        void            *data;
-};
-
-struct pci_visit {
-        int (* pre_visit_pci_bus)       (struct pci_bus_wrapped *,
-                                         struct pci_dev_wrapped *);
-        int (* post_visit_pci_bus)      (struct pci_bus_wrapped *,
-                                         struct pci_dev_wrapped *);
-
-        int (* pre_visit_pci_dev)       (struct pci_dev_wrapped *,
-                                         struct pci_bus_wrapped *);
-        int (* visit_pci_dev)           (struct pci_dev_wrapped *,
-                                         struct pci_bus_wrapped *);
-        int (* post_visit_pci_dev)      (struct pci_dev_wrapped *,
-                                         struct pci_bus_wrapped *);
-};
-
-extern int pci_visit_dev(struct pci_visit *fn,
-                         struct pci_dev_wrapped *wrapped_dev,
-                         struct pci_bus_wrapped *wrapped_parent);
 extern void pci_remove_legacy_files(struct pci_bus *bus);
 
 /* Lock for read/write access to pci device and bus lists */
diff --git a/drivers/pci/pcie/portdrv_bus.c b/drivers/pci/pcie/portdrv_bus.c
index 4037a3e568de..3e84b501e6a4 100644
--- a/drivers/pci/pcie/portdrv_bus.c
+++ b/drivers/pci/pcie/portdrv_bus.c
@@ -39,7 +39,8 @@ static int pcie_port_bus_match(struct device *dev, struct device_driver *drv)
                 driver->id_table->vendor != pciedev->id.vendor) ||
                (driver->id_table->device != PCI_ANY_ID &&
                 driver->id_table->device != pciedev->id.device) ||      
-                driver->id_table->port_type != pciedev->id.port_type ||
+               (driver->id_table->port_type != PCIE_ANY_PORT &&
+                driver->id_table->port_type != pciedev->id.port_type) ||
                 driver->id_table->service_type != pciedev->id.service_type )
                 return 0;
 
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 66150d08b5c7..c4ade288c5da 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -1592,9 +1592,9 @@ static int __init init_pcmcia_bus(void)
 
         /* Set up character device for user mode clients */
         i = register_chrdev(0, "pcmcia", &ds_fops);
-        if (i == -EBUSY)
+        if (i < 0)
                 printk(KERN_NOTICE "unable to find a free device # for "
-                       "Driver Services\n");
+                       "Driver Services (error=%d)\n", i);
         else
                 major_dev = i;
 
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index 3f4364341d8d..20642f0e7bfe 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -744,7 +744,7 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
 
         for (i = 0; i < MAX_SOCKETS; i++) {
                 socket[i].io_base = pci_resource_start(dev, 0);
-                socket[i].socket.features |= SS_CAP_PCCARD;
+                socket[i].socket.features |= SS_CAP_PAGE_REGS | SS_CAP_PCCARD;
                 socket[i].socket.map_size = 0x1000;
                 socket[i].socket.irq_mask = mask;
                 socket[i].socket.pci_irq  = dev->irq;
diff --git a/drivers/pcmcia/ti113x.h b/drivers/pcmcia/ti113x.h
index 52c073a9d7e4..a8a1d104524a 100644
--- a/drivers/pcmcia/ti113x.h
+++ b/drivers/pcmcia/ti113x.h
@@ -442,6 +442,25 @@ out:
 }
 
 
+/* changes the irq of func1 to match that of func0 */
+static int ti12xx_align_irqs(struct yenta_socket *socket, int *old_irq)
+{
+        struct pci_dev *func0;
+
+        /* find func0 device */
+        func0 = pci_get_slot(socket->dev->bus, socket->dev->devfn & ~0x07);
+        if (!func0)
+                return 0;
+
+        if (old_irq)
+                *old_irq = socket->cb_irq;
+        socket->cb_irq = socket->dev->irq = func0->irq;
+
+        pci_dev_put(func0);
+
+        return 1;
+}
+
 /*
  * ties INTA and INTB together. also changes the devices irq to that of
  * the function 0 device. call from func1 only.
@@ -449,26 +468,22 @@ out:
  */
 static int ti12xx_tie_interrupts(struct yenta_socket *socket, int *old_irq)
 {
-        struct pci_dev *func0;
         u32 sysctl;
+        int ret;
 
         sysctl = config_readl(socket, TI113X_SYSTEM_CONTROL);
         if (sysctl & TI122X_SCR_INTRTIE)
                 return 0;
 
-        /* find func0 device */
-        func0 = pci_get_slot(socket->dev->bus, socket->dev->devfn & ~0x07);
-        if (!func0)
+        /* align */
+        ret = ti12xx_align_irqs(socket, old_irq);
+        if (!ret)
                 return 0;
 
-        /* change the interrupt to match func0, tie 'em up */
-        *old_irq = socket->cb_irq;
-        socket->cb_irq = socket->dev->irq = func0->irq;
+        /* tie */
         sysctl |= TI122X_SCR_INTRTIE;
         config_writel(socket, TI113X_SYSTEM_CONTROL, sysctl);
 
-        pci_dev_put(func0);
-
         return 1;
 }
 
@@ -489,7 +504,7 @@ static void ti12xx_untie_interrupts(struct yenta_socket *socket, int old_irq)
  */
 static void ti12xx_irqroute_func1(struct yenta_socket *socket)
 {
-        u32 mfunc, mfunc_old, devctl;
+        u32 mfunc, mfunc_old, devctl, sysctl;
         int pci_irq_status;
 
         mfunc = mfunc_old = config_readl(socket, TI122X_MFUNC);
@@ -497,6 +512,11 @@ static void ti12xx_irqroute_func1(struct yenta_socket *socket)
         printk(KERN_INFO "Yenta TI: socket %s, mfunc 0x%08x, devctl 0x%02x\n",
                pci_name(socket->dev), mfunc, devctl);
 
+        /* if IRQs are configured as tied, align irq of func1 with func0 */
+        sysctl = config_readl(socket, TI113X_SYSTEM_CONTROL);
+        if (sysctl & TI122X_SCR_INTRTIE)
+                ti12xx_align_irqs(socket, NULL);
+
         /* make sure PCI interrupts are enabled before probing */
         ti_init(socket);
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 02cfe244e069..ceeb3cf64a16 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -7,7 +7,7 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999-2001
  *
- * $Revision: 1.161 $
+ * $Revision: 1.164 $
  */
 
 #include <linux/config.h>
@@ -1766,10 +1766,10 @@ dasd_generic_probe (struct ccw_device *cdev,
                 printk(KERN_WARNING
                        "dasd_generic_probe: could not add sysfs entries "
                        "for %s\n", cdev->dev.bus_id);
+        } else {
+                cdev->handler = &dasd_int_handler;
         }
 
-        cdev->handler = &dasd_int_handler;
-
         return ret;
 }
 
@@ -1780,6 +1780,8 @@ dasd_generic_remove (struct ccw_device *cdev)
 {
         struct dasd_device *device;
 
+        cdev->handler = NULL;
+
         dasd_remove_sysfs_files(cdev);
         device = dasd_device_from_cdev(cdev);
         if (IS_ERR(device))
@@ -1810,14 +1812,14 @@ dasd_generic_set_online (struct ccw_device *cdev,
         struct dasd_device *device;
         int feature_diag, rc;
 
-        feature_diag = dasd_get_feature(cdev, DASD_FEATURE_USEDIAG);
-        if (feature_diag < 0)
-                return feature_diag;
-
         device = dasd_create_device(cdev);
         if (IS_ERR(device))
                 return PTR_ERR(device);
 
+        feature_diag = dasd_get_feature(cdev, DASD_FEATURE_USEDIAG);
+        if (feature_diag < 0)
+                return feature_diag;
+
         if (feature_diag) {
                 if (!dasd_diag_discipline_pointer) {
                         printk (KERN_WARNING
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 1f9aeb4accc6..68d151aaa474 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -52,7 +52,7 @@ static inline int zfcp_sg_list_copy_from_user(struct zfcp_sg_list *,
 static inline int zfcp_sg_list_copy_to_user(void __user *,
                                             struct zfcp_sg_list *, size_t);
 
-static int zfcp_cfdc_dev_ioctl(struct file *, unsigned int, unsigned long);
+static long zfcp_cfdc_dev_ioctl(struct file *, unsigned int, unsigned long);
 
 #define ZFCP_CFDC_IOC_MAGIC                     0xDD
 #define ZFCP_CFDC_IOC \
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 0afa1c4696ca..c5daf372f853 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -61,7 +61,6 @@
 #include <linux/mempool.h>
 #include <linux/syscalls.h>
 #include <linux/ioctl.h>
-#include <linux/ioctl32.h>
 
 /************************ DEBUG FLAGS *****************************************/
 
diff --git a/drivers/sbus/char/aurora.c b/drivers/sbus/char/aurora.c
index e5fa1703856b..650d5e924f47 100644
--- a/drivers/sbus/char/aurora.c
+++ b/drivers/sbus/char/aurora.c
@@ -81,10 +81,6 @@ unsigned char irqs[4] = {
 int irqhit=0;
 #endif
 
-#ifndef MIN
-#define MIN(a,b) ((a) < (b) ? (a) : (b))
-#endif
-
 static struct tty_driver *aurora_driver;
 static struct Aurora_board aurora_board[AURORA_NBOARD] = {
         {0,},
@@ -594,7 +590,7 @@ static void aurora_transmit(struct Aurora_board const * bp, int chip)
                                             &bp->r[chip]->r[CD180_TDR]);
                                 port->COR2 &= ~COR2_ETC;
                         }
-                        count = MIN(port->break_length, 0xff);
+                        count = min(port->break_length, 0xff);
                         sbus_writeb(CD180_C_ESC,
                                     &bp->r[chip]->r[CD180_TDR]);
                         sbus_writeb(CD180_C_DELAY,
@@ -1575,7 +1571,7 @@ static int aurora_write(struct tty_struct * tty,
         save_flags(flags);
         while (1) {
                 cli();
-                c = MIN(count, MIN(SERIAL_XMIT_SIZE - port->xmit_cnt - 1,
+                c = min(count, min(SERIAL_XMIT_SIZE - port->xmit_cnt - 1,
                                    SERIAL_XMIT_SIZE - port->xmit_head));
                 if (c <= 0) {
                         restore_flags(flags);
diff --git a/drivers/scsi/NCR53C9x.c b/drivers/scsi/NCR53C9x.c
index 3c86655a5f33..74b93564a258 100644
--- a/drivers/scsi/NCR53C9x.c
+++ b/drivers/scsi/NCR53C9x.c
@@ -1824,7 +1824,10 @@ static int esp_do_data(struct NCR_ESP *esp, struct ESP_regs *eregs)
                 /* loop */
                 while (hmuch) {
                         int j, fifo_stuck = 0, newphase;
-                        unsigned long flags, timeout;
+                        unsigned long timeout;
+#if 0
+                        unsigned long flags;
+#endif
 #if 0
                         if ( i % 10 )
                                 ESPDATA(("\r"));
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index c9b82687ba1a..242fa77513f5 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -450,7 +450,7 @@ static int aac_cfg_open(struct inode *inode, struct file *file)
                 }
         }
 
-        return 0;
+        return err;
 }
 
 /**
diff --git a/drivers/scsi/aic7xxx/aic7770_osm.c b/drivers/scsi/aic7xxx/aic7770_osm.c
index c2b47f2bdffd..682ca0b32b44 100644
--- a/drivers/scsi/aic7xxx/aic7770_osm.c
+++ b/drivers/scsi/aic7xxx/aic7770_osm.c
@@ -41,7 +41,6 @@
 
 #include "aic7xxx_osm.h"
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
 #include <linux/device.h>
 #include <linux/eisa.h>
 
@@ -62,13 +61,6 @@ static struct eisa_driver aic7770_driver = {
 };
 
 typedef  struct device *aic7770_dev_t;
-#else
-#define MINSLOT                 1
-#define NUMSLOTS                16
-#define IDOFFSET                0x80
-
-typedef void *aic7770_dev_t;
-#endif
 
 static int aic7770_linux_config(struct aic7770_identity *entry,
                                 aic7770_dev_t dev, u_int eisaBase);
@@ -76,7 +68,6 @@ static int aic7770_linux_config(struct aic7770_identity *entry,
 int
 ahc_linux_eisa_init(void)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
         struct eisa_device_id *eid;
         struct aic7770_identity *id;
         int i;
@@ -110,44 +101,6 @@ ahc_linux_eisa_init(void)
         eid->sig[0] = 0;
 
         return eisa_driver_register(&aic7770_driver);
-#else /* LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0) */
-        struct aic7770_identity *entry;
-        u_int  slot;
-        u_int  eisaBase;
-        u_int  i;
-        int ret = -ENODEV;
-
-        if (aic7xxx_probe_eisa_vl == 0)
-                return ret;
-
-        eisaBase = 0x1000 + AHC_EISA_SLOT_OFFSET;
-        for (slot = 1; slot < NUMSLOTS; eisaBase+=0x1000, slot++) {
-                uint32_t eisa_id;
-                size_t   id_size;
-
-                if (request_region(eisaBase, AHC_EISA_IOSIZE, "aic7xxx") == 0)
-                        continue;
-
-                eisa_id = 0;
-                id_size = sizeof(eisa_id);
-                for (i = 0; i < 4; i++) {
-                        /* VLcards require priming*/
-                        outb(0x80 + i, eisaBase + IDOFFSET);
-                        eisa_id |= inb(eisaBase + IDOFFSET + i)
-                                   << ((id_size-i-1) * 8);
-                }
-                release_region(eisaBase, AHC_EISA_IOSIZE);
-                if (eisa_id & 0x80000000)
-                        continue;  /* no EISA card in slot */
-
-                entry = aic7770_find_device(eisa_id);
-                if (entry != NULL) {
-                        aic7770_linux_config(entry, NULL, eisaBase);
-                        ret = 0;
-                }
-        }
-        return ret;
-#endif
 }
 
 void
@@ -187,11 +140,10 @@ aic7770_linux_config(struct aic7770_identity *entry, aic7770_dev_t dev,
                 ahc_free(ahc);
                 return (error);
         }
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
+
         dev->driver_data = (void *)ahc;
         if (aic7xxx_detect_complete)
                 error = ahc_linux_register_host(ahc, &aic7xxx_driver_template);
-#endif
         return (error);
 }
 
@@ -225,7 +177,6 @@ aic7770_map_int(struct ahc_softc *ahc, u_int irq)
         return (-error);
 }
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
 static int
 aic7770_eisa_dev_probe(struct device *dev)
 {
@@ -261,4 +212,3 @@ aic7770_eisa_dev_remove(struct device *dev)
 
         return (0);
 }
-#endif
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index e60f9338e44a..f90efa265ba2 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -134,11 +134,6 @@ static struct scsi_transport_template *ahc_linux_transport_template = NULL;
 #include "aiclib.c"
 
 #include <linux/init.h>         /* __setup */
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-#include "sd.h"                 /* For geometry detection */
-#endif
-
 #include <linux/mm.h>           /* For fetching system memory size */
 #include <linux/blkdev.h>               /* For block_size() */
 #include <linux/delay.h>        /* For ssleep/msleep */
@@ -148,11 +143,6 @@ static struct scsi_transport_template *ahc_linux_transport_template = NULL;
  */
 spinlock_t ahc_list_spinlock;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-/* For dynamic sglist size calculation. */
-u_int ahc_linux_nseg;
-#endif
-
 /*
  * Set this to the delay in seconds after SCSI bus reset.
  * Note, we honor this only for the initial bus reset.
@@ -436,15 +426,12 @@ static void ahc_linux_handle_scsi_status(struct ahc_softc *,
                                          struct ahc_linux_device *,
                                          struct scb *);
 static void ahc_linux_queue_cmd_complete(struct ahc_softc *ahc,
-                                         Scsi_Cmnd *cmd);
+                                         struct scsi_cmnd *cmd);
 static void ahc_linux_sem_timeout(u_long arg);
 static void ahc_linux_freeze_simq(struct ahc_softc *ahc);
 static void ahc_linux_release_simq(u_long arg);
-static void ahc_linux_dev_timed_unfreeze(u_long arg);
-static int  ahc_linux_queue_recovery_cmd(Scsi_Cmnd *cmd, scb_flag flag);
+static int  ahc_linux_queue_recovery_cmd(struct scsi_cmnd *cmd, scb_flag flag);
 static void ahc_linux_initialize_scsi_bus(struct ahc_softc *ahc);
-static void ahc_linux_size_nseg(void);
-static void ahc_linux_thread_run_complete_queue(struct ahc_softc *ahc);
 static u_int ahc_linux_user_tagdepth(struct ahc_softc *ahc,
                                      struct ahc_devinfo *devinfo);
 static void ahc_linux_device_queue_depth(struct ahc_softc *ahc,
@@ -458,54 +445,27 @@ static struct ahc_linux_device*	ahc_linux_alloc_device(struct ahc_softc*,
                                                        u_int);
 static void                     ahc_linux_free_device(struct ahc_softc*,
                                                       struct ahc_linux_device*);
-static void ahc_linux_run_device_queue(struct ahc_softc*,
-                                       struct ahc_linux_device*);
+static int ahc_linux_run_command(struct ahc_softc*,
+                                 struct ahc_linux_device *,
+                                 struct scsi_cmnd *);
 static void ahc_linux_setup_tag_info_global(char *p);
 static aic_option_callback_t ahc_linux_setup_tag_info;
 static int  aic7xxx_setup(char *s);
 static int  ahc_linux_next_unit(void);
-static void ahc_runq_tasklet(unsigned long data);
-static struct ahc_cmd *ahc_linux_run_complete_queue(struct ahc_softc *ahc);
 
 /********************************* Inlines ************************************/
-static __inline void ahc_schedule_runq(struct ahc_softc *ahc);
 static __inline struct ahc_linux_device*
                      ahc_linux_get_device(struct ahc_softc *ahc, u_int channel,
-                                          u_int target, u_int lun, int alloc);
-static __inline void ahc_schedule_completeq(struct ahc_softc *ahc);
-static __inline void ahc_linux_check_device_queue(struct ahc_softc *ahc,
-                                                  struct ahc_linux_device *dev);
-static __inline struct ahc_linux_device *
-                     ahc_linux_next_device_to_run(struct ahc_softc *ahc);
-static __inline void ahc_linux_run_device_queues(struct ahc_softc *ahc);
+                                          u_int target, u_int lun);
 static __inline void ahc_linux_unmap_scb(struct ahc_softc*, struct scb*);
 
 static __inline int ahc_linux_map_seg(struct ahc_softc *ahc, struct scb *scb,
                                       struct ahc_dma_seg *sg,
                                       dma_addr_t addr, bus_size_t len);
 
-static __inline void
-ahc_schedule_completeq(struct ahc_softc *ahc)
-{
-        if ((ahc->platform_data->flags & AHC_RUN_CMPLT_Q_TIMER) == 0) {
-                ahc->platform_data->flags |= AHC_RUN_CMPLT_Q_TIMER;
-                ahc->platform_data->completeq_timer.expires = jiffies;
-                add_timer(&ahc->platform_data->completeq_timer);
-        }
-}
-
-/*
- * Must be called with our lock held.
- */
-static __inline void
-ahc_schedule_runq(struct ahc_softc *ahc)
-{
-        tasklet_schedule(&ahc->platform_data->runq_tasklet);
-}
-
 static __inline struct ahc_linux_device*
 ahc_linux_get_device(struct ahc_softc *ahc, u_int channel, u_int target,
-                     u_int lun, int alloc)
+                     u_int lun)
 {
         struct ahc_linux_target *targ;
         struct ahc_linux_device *dev;
@@ -515,102 +475,15 @@ ahc_linux_get_device(struct ahc_softc *ahc, u_int channel, u_int target,
         if (channel != 0)
                 target_offset += 8;
         targ = ahc->platform_data->targets[target_offset];
-        if (targ == NULL) {
-                if (alloc != 0) {
-                        targ = ahc_linux_alloc_target(ahc, channel, target);
-                        if (targ == NULL)
-                                return (NULL);
-                } else
-                        return (NULL);
-        }
+        BUG_ON(targ == NULL);
         dev = targ->devices[lun];
-        if (dev == NULL && alloc != 0)
-                dev = ahc_linux_alloc_device(ahc, targ, lun);
-        return (dev);
-}
-
-#define AHC_LINUX_MAX_RETURNED_ERRORS 4
-static struct ahc_cmd *
-ahc_linux_run_complete_queue(struct ahc_softc *ahc)
-{
-        struct  ahc_cmd *acmd;
-        u_long  done_flags;
-        int     with_errors;
-
-        with_errors = 0;
-        ahc_done_lock(ahc, &done_flags);
-        while ((acmd = TAILQ_FIRST(&ahc->platform_data->completeq)) != NULL) {
-                Scsi_Cmnd *cmd;
-
-                if (with_errors > AHC_LINUX_MAX_RETURNED_ERRORS) {
-                        /*
-                         * Linux uses stack recursion to requeue
-                         * commands that need to be retried.  Avoid
-                         * blowing out the stack by "spoon feeding"
-                         * commands that completed with error back
-                         * the operating system in case they are going
-                         * to be retried. "ick"
-                         */
-                        ahc_schedule_completeq(ahc);
-                        break;
-                }
-                TAILQ_REMOVE(&ahc->platform_data->completeq,
-                             acmd, acmd_links.tqe);
-                cmd = &acmd_scsi_cmd(acmd);
-                cmd->host_scribble = NULL;
-                if (ahc_cmd_get_transaction_status(cmd) != DID_OK
-                 || (cmd->result & 0xFF) != SCSI_STATUS_OK)
-                        with_errors++;
-
-                cmd->scsi_done(cmd);
-        }
-        ahc_done_unlock(ahc, &done_flags);
-        return (acmd);
-}
-
-static __inline void
-ahc_linux_check_device_queue(struct ahc_softc *ahc,
-                             struct ahc_linux_device *dev)
-{
-        if ((dev->flags & AHC_DEV_FREEZE_TIL_EMPTY) != 0
-         && dev->active == 0) {
-                dev->flags &= ~AHC_DEV_FREEZE_TIL_EMPTY;
-                dev->qfrozen--;
-        }
-
-        if (TAILQ_FIRST(&dev->busyq) == NULL
-         || dev->openings == 0 || dev->qfrozen != 0)
-                return;
-
-        ahc_linux_run_device_queue(ahc, dev);
-}
-
-static __inline struct ahc_linux_device *
-ahc_linux_next_device_to_run(struct ahc_softc *ahc)
-{
-        
-        if ((ahc->flags & AHC_RESOURCE_SHORTAGE) != 0
-            || (ahc->platform_data->qfrozen != 0))
-                return (NULL);
-        return (TAILQ_FIRST(&ahc->platform_data->device_runq));
-}
-
-static __inline void
-ahc_linux_run_device_queues(struct ahc_softc *ahc)
-{
-        struct ahc_linux_device *dev;
-
-        while ((dev = ahc_linux_next_device_to_run(ahc)) != NULL) {
-                TAILQ_REMOVE(&ahc->platform_data->device_runq, dev, links);
-                dev->flags &= ~AHC_DEV_ON_RUN_LIST;
-                ahc_linux_check_device_queue(ahc, dev);
-        }
+        return dev;
 }
 
 static __inline void
 ahc_linux_unmap_scb(struct ahc_softc *ahc, struct scb *scb)
 {
-        Scsi_Cmnd *cmd;
+        struct scsi_cmnd *cmd;
 
         cmd = scb->io_ctx;
         ahc_sync_sglist(ahc, scb, BUS_DMASYNC_POSTWRITE);
@@ -650,109 +523,15 @@ ahc_linux_map_seg(struct ahc_softc *ahc, struct scb *scb,
         return (consumed);
 }
 
-/************************  Host template entry points *************************/
-static int         ahc_linux_detect(Scsi_Host_Template *);
-static int         ahc_linux_queue(Scsi_Cmnd *, void (*)(Scsi_Cmnd *));
-static const char *ahc_linux_info(struct Scsi_Host *);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-static int         ahc_linux_slave_alloc(Scsi_Device *);
-static int         ahc_linux_slave_configure(Scsi_Device *);
-static void        ahc_linux_slave_destroy(Scsi_Device *);
-#if defined(__i386__)
-static int         ahc_linux_biosparam(struct scsi_device*,
-                                       struct block_device*,
-                                       sector_t, int[]);
-#endif
-#else
-static int         ahc_linux_release(struct Scsi_Host *);
-static void        ahc_linux_select_queue_depth(struct Scsi_Host *host,
-                                                Scsi_Device *scsi_devs);
-#if defined(__i386__)
-static int         ahc_linux_biosparam(Disk *, kdev_t, int[]);
-#endif
-#endif
-static int         ahc_linux_bus_reset(Scsi_Cmnd *);
-static int         ahc_linux_dev_reset(Scsi_Cmnd *);
-static int         ahc_linux_abort(Scsi_Cmnd *);
-
-/*
- * Calculate a safe value for AHC_NSEG (as expressed through ahc_linux_nseg).
- *
- * In pre-2.5.X...
- * The midlayer allocates an S/G array dynamically when a command is issued
- * using SCSI malloc.  This array, which is in an OS dependent format that
- * must later be copied to our private S/G list, is sized to house just the
- * number of segments needed for the current transfer.  Since the code that
- * sizes the SCSI malloc pool does not take into consideration fragmentation
- * of the pool, executing transactions numbering just a fraction of our
- * concurrent transaction limit with list lengths aproaching AHC_NSEG will
- * quickly depleat the SCSI malloc pool of usable space.  Unfortunately, the
- * mid-layer does not properly handle this scsi malloc failures for the S/G
- * array and the result can be a lockup of the I/O subsystem.  We try to size
- * our S/G list so that it satisfies our drivers allocation requirements in
- * addition to avoiding fragmentation of the SCSI malloc pool.
- */
-static void
-ahc_linux_size_nseg(void)
-{
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-        u_int cur_size;
-        u_int best_size;
-
-        /*
-         * The SCSI allocator rounds to the nearest 512 bytes
-         * an cannot allocate across a page boundary.  Our algorithm
-         * is to start at 1K of scsi malloc space per-command and
-         * loop through all factors of the PAGE_SIZE and pick the best.
-         */
-        best_size = 0;
-        for (cur_size = 1024; cur_size <= PAGE_SIZE; cur_size *= 2) {
-                u_int nseg;
-
-                nseg = cur_size / sizeof(struct scatterlist);
-                if (nseg < AHC_LINUX_MIN_NSEG)
-                        continue;
-
-                if (best_size == 0) {
-                        best_size = cur_size;
-                        ahc_linux_nseg = nseg;
-                } else {
-                        u_int best_rem;
-                        u_int cur_rem;
-
-                        /*
-                         * Compare the traits of the current "best_size"
-                         * with the current size to determine if the
-                         * current size is a better size.
-                         */
-                        best_rem = best_size % sizeof(struct scatterlist);
-                        cur_rem = cur_size % sizeof(struct scatterlist);
-                        if (cur_rem < best_rem) {
-                                best_size = cur_size;
-                                ahc_linux_nseg = nseg;
-                        }
-                }
-        }
-#endif
-}
-
 /*
  * Try to detect an Adaptec 7XXX controller.
  */
 static int
-ahc_linux_detect(Scsi_Host_Template *template)
+ahc_linux_detect(struct scsi_host_template *template)
 {
         struct  ahc_softc *ahc;
         int     found = 0;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-        /*
-         * It is a bug that the upper layer takes
-         * this lock just prior to calling us.
-         */
-        spin_unlock_irq(&io_request_lock);
-#endif
-
         /*
          * Sanity checking of Linux SCSI data structures so
          * that some of our hacks^H^H^H^H^Hassumptions aren't
@@ -764,7 +543,6 @@ ahc_linux_detect(Scsi_Host_Template *template)
                 printf("ahc_linux_detect: Unable to attach\n");
                 return (0);
         }
-        ahc_linux_size_nseg();
         /*
          * If we've been passed any parameters, process them now.
          */
@@ -793,48 +571,11 @@ ahc_linux_detect(Scsi_Host_Template *template)
                         found++;
         }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-        spin_lock_irq(&io_request_lock);
-#endif
         aic7xxx_detect_complete++;
 
         return (found);
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-/*
- * Free the passed in Scsi_Host memory structures prior to unloading the
- * module.
- */
-int
-ahc_linux_release(struct Scsi_Host * host)
-{
-        struct ahc_softc *ahc;
-        u_long l;
-
-        ahc_list_lock(&l);
-        if (host != NULL) {
-
-                /*
-                 * We should be able to just perform
-                 * the free directly, but check our
-                 * list for extra sanity.
-                 */
-                ahc = ahc_find_softc(*(struct ahc_softc **)host->hostdata);
-                if (ahc != NULL) {
-                        u_long s;
-
-                        ahc_lock(ahc, &s);
-                        ahc_intr_enable(ahc, FALSE);
-                        ahc_unlock(ahc, &s);
-                        ahc_free(ahc);
-                }
-        }
-        ahc_list_unlock(&l);
-        return (0);
-}
-#endif
-
 /*
  * Return a string describing the driver.
  */
@@ -867,11 +608,10 @@ ahc_linux_info(struct Scsi_Host *host)
  * Queue an SCB to the controller.
  */
 static int
-ahc_linux_queue(Scsi_Cmnd * cmd, void (*scsi_done) (Scsi_Cmnd *))
+ahc_linux_queue(struct scsi_cmnd * cmd, void (*scsi_done) (struct scsi_cmnd *))
 {
         struct   ahc_softc *ahc;
         struct   ahc_linux_device *dev;
-        u_long   flags;
 
         ahc = *(struct ahc_softc **)cmd->device->host->hostdata;
 
@@ -880,205 +620,149 @@ ahc_linux_queue(Scsi_Cmnd * cmd, void (*scsi_done) (Scsi_Cmnd *))
          */
         cmd->scsi_done = scsi_done;
 
-        ahc_midlayer_entrypoint_lock(ahc, &flags);
-
         /*
          * Close the race of a command that was in the process of
          * being queued to us just as our simq was frozen.  Let
          * DV commands through so long as we are only frozen to
          * perform DV.
          */
-        if (ahc->platform_data->qfrozen != 0) {
+        if (ahc->platform_data->qfrozen != 0)
+                return SCSI_MLQUEUE_HOST_BUSY;
 
-                ahc_cmd_set_transaction_status(cmd, CAM_REQUEUE_REQ);
-                ahc_linux_queue_cmd_complete(ahc, cmd);
-                ahc_schedule_completeq(ahc);
-                ahc_midlayer_entrypoint_unlock(ahc, &flags);
-                return (0);
-        }
         dev = ahc_linux_get_device(ahc, cmd->device->channel, cmd->device->id,
-                                   cmd->device->lun, /*alloc*/TRUE);
-        if (dev == NULL) {
-                ahc_cmd_set_transaction_status(cmd, CAM_RESRC_UNAVAIL);
-                ahc_linux_queue_cmd_complete(ahc, cmd);
-                ahc_schedule_completeq(ahc);
-                ahc_midlayer_entrypoint_unlock(ahc, &flags);
-                printf("%s: aic7xxx_linux_queue - Unable to allocate device!\n",
-                       ahc_name(ahc));
-                return (0);
-        }
+                                   cmd->device->lun);
+        BUG_ON(dev == NULL);
+
         cmd->result = CAM_REQ_INPROG << 16;
-        TAILQ_INSERT_TAIL(&dev->busyq, (struct ahc_cmd *)cmd, acmd_links.tqe);
-        if ((dev->flags & AHC_DEV_ON_RUN_LIST) == 0) {
-                TAILQ_INSERT_TAIL(&ahc->platform_data->device_runq, dev, links);
-                dev->flags |= AHC_DEV_ON_RUN_LIST;
-                ahc_linux_run_device_queues(ahc);
-        }
-        ahc_midlayer_entrypoint_unlock(ahc, &flags);
-        return (0);
+
+        return ahc_linux_run_command(ahc, dev, cmd);
 }
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
 static int
-ahc_linux_slave_alloc(Scsi_Device *device)
+ahc_linux_slave_alloc(struct scsi_device *device)
 {
         struct  ahc_softc *ahc;
+        struct ahc_linux_target *targ;
+        struct scsi_target *starget = device->sdev_target;
+        struct ahc_linux_device *dev;
+        unsigned int target_offset;
+        unsigned long flags;
+        int retval = -ENOMEM;
+
+        target_offset = starget->id;
+        if (starget->channel != 0)
+                target_offset += 8;
 
         ahc = *((struct ahc_softc **)device->host->hostdata);
         if (bootverbose)
                 printf("%s: Slave Alloc %d\n", ahc_name(ahc), device->id);
-        return (0);
+        ahc_lock(ahc, &flags);
+        targ = ahc->platform_data->targets[target_offset];
+        if (targ == NULL) {
+                targ = ahc_linux_alloc_target(ahc, starget->channel, starget->id);
+                struct seeprom_config *sc = ahc->seep_config;
+                if (targ == NULL)
+                        goto out;
+
+                if (sc) {
+                        unsigned short scsirate;
+                        struct ahc_devinfo devinfo;
+                        struct ahc_initiator_tinfo *tinfo;
+                        struct ahc_tmode_tstate *tstate;
+                        char channel = starget->channel + 'A';
+                        unsigned int our_id = ahc->our_id;
+
+                        if (starget->channel)
+                                our_id = ahc->our_id_b;
+
+                        if ((ahc->features & AHC_ULTRA2) != 0) {
+                                scsirate = sc->device_flags[target_offset] & CFXFER;
+                        } else {
+                                scsirate = (sc->device_flags[target_offset] & CFXFER) << 4;
+                                if (sc->device_flags[target_offset] & CFSYNCH)
+                                        scsirate |= SOFS;
+                        }
+                        if (sc->device_flags[target_offset] & CFWIDEB) {
+                                scsirate |= WIDEXFER;
+                                spi_max_width(starget) = 1;
+                        } else
+                                spi_max_width(starget) = 0;
+                        spi_min_period(starget) = 
+                                ahc_find_period(ahc, scsirate, AHC_SYNCRATE_DT);
+                        tinfo = ahc_fetch_transinfo(ahc, channel, ahc->our_id,
+                                                    targ->target, &tstate);
+                        ahc_compile_devinfo(&devinfo, our_id, targ->target,
+                                            CAM_LUN_WILDCARD, channel,
+                                            ROLE_INITIATOR);
+                        ahc_set_syncrate(ahc, &devinfo, NULL, 0, 0, 0,
+                                         AHC_TRANS_GOAL, /*paused*/FALSE);
+                        ahc_set_width(ahc, &devinfo, MSG_EXT_WDTR_BUS_8_BIT,
+                                      AHC_TRANS_GOAL, /*paused*/FALSE);
+                }
+                        
+        }
+        dev = targ->devices[device->lun];
+        if (dev == NULL) {
+                dev = ahc_linux_alloc_device(ahc, targ, device->lun);
+                if (dev == NULL)
+                        goto out;
+        }
+        retval = 0;
+
+ out:
+        ahc_unlock(ahc, &flags);
+        return retval;
 }
 
 static int
-ahc_linux_slave_configure(Scsi_Device *device)
+ahc_linux_slave_configure(struct scsi_device *device)
 {
         struct  ahc_softc *ahc;
         struct  ahc_linux_device *dev;
-        u_long  flags;
 
         ahc = *((struct ahc_softc **)device->host->hostdata);
+
         if (bootverbose)
                 printf("%s: Slave Configure %d\n", ahc_name(ahc), device->id);
-        ahc_midlayer_entrypoint_lock(ahc, &flags);
-        /*
-         * Since Linux has attached to the device, configure
-         * it so we don't free and allocate the device
-         * structure on every command.
-         */
-        dev = ahc_linux_get_device(ahc, device->channel,
-                                   device->id, device->lun,
-                                   /*alloc*/TRUE);
-        if (dev != NULL) {
-                dev->flags &= ~AHC_DEV_UNCONFIGURED;
-                dev->scsi_device = device;
-                ahc_linux_device_queue_depth(ahc, dev);
-        }
-        ahc_midlayer_entrypoint_unlock(ahc, &flags);
+
+        dev = ahc_linux_get_device(ahc, device->channel, device->id,
+                                   device->lun);
+        dev->scsi_device = device;
+        ahc_linux_device_queue_depth(ahc, dev);
 
         /* Initial Domain Validation */
         if (!spi_initial_dv(device->sdev_target))
                 spi_dv_device(device);
 
-        return (0);
+        return 0;
 }
 
 static void
-ahc_linux_slave_destroy(Scsi_Device *device)
+ahc_linux_slave_destroy(struct scsi_device *device)
 {
         struct  ahc_softc *ahc;
         struct  ahc_linux_device *dev;
-        u_long  flags;
 
         ahc = *((struct ahc_softc **)device->host->hostdata);
         if (bootverbose)
                 printf("%s: Slave Destroy %d\n", ahc_name(ahc), device->id);
-        ahc_midlayer_entrypoint_lock(ahc, &flags);
         dev = ahc_linux_get_device(ahc, device->channel,
-                                   device->id, device->lun,
-                                           /*alloc*/FALSE);
-        /*
-         * Filter out "silly" deletions of real devices by only
-         * deleting devices that have had slave_configure()
-         * called on them.  All other devices that have not
-         * been configured will automatically be deleted by
-         * the refcounting process.
-         */
-        if (dev != NULL
-         && (dev->flags & AHC_DEV_SLAVE_CONFIGURED) != 0) {
-                dev->flags |= AHC_DEV_UNCONFIGURED;
-                if (TAILQ_EMPTY(&dev->busyq)
-                 && dev->active == 0
-                 && (dev->flags & AHC_DEV_TIMER_ACTIVE) == 0)
-                        ahc_linux_free_device(ahc, dev);
-        }
-        ahc_midlayer_entrypoint_unlock(ahc, &flags);
-}
-#else
-/*
- * Sets the queue depth for each SCSI device hanging
- * off the input host adapter.
- */
-static void
-ahc_linux_select_queue_depth(struct Scsi_Host *host, Scsi_Device *scsi_devs)
-{
-        Scsi_Device *device;
-        Scsi_Device *ldev;
-        struct  ahc_softc *ahc;
-        u_long  flags;
+                                   device->id, device->lun);
 
-        ahc = *((struct ahc_softc **)host->hostdata);
-        ahc_lock(ahc, &flags);
-        for (device = scsi_devs; device != NULL; device = device->next) {
+        BUG_ON(dev->active);
 
-                /*
-                 * Watch out for duplicate devices.  This works around
-                 * some quirks in how the SCSI scanning code does its
-                 * device management.
-                 */
-                for (ldev = scsi_devs; ldev != device; ldev = ldev->next) {
-                        if (ldev->host == device->host
-                         && ldev->channel == device->channel
-                         && ldev->id == device->id
-                         && ldev->lun == device->lun)
-                                break;
-                }
-                /* Skip duplicate. */
-                if (ldev != device)
-                        continue;
-
-                if (device->host == host) {
-                        struct   ahc_linux_device *dev;
-
-                        /*
-                         * Since Linux has attached to the device, configure
-                         * it so we don't free and allocate the device
-                         * structure on every command.
-                         */
-                        dev = ahc_linux_get_device(ahc, device->channel,
-                                                   device->id, device->lun,
-                                                   /*alloc*/TRUE);
-                        if (dev != NULL) {
-                                dev->flags &= ~AHC_DEV_UNCONFIGURED;
-                                dev->scsi_device = device;
-                                ahc_linux_device_queue_depth(ahc, dev);
-                                device->queue_depth = dev->openings
-                                                    + dev->active;
-                                if ((dev->flags & (AHC_DEV_Q_BASIC
-                                                | AHC_DEV_Q_TAGGED)) == 0) {
-                                        /*
-                                         * We allow the OS to queue 2 untagged
-                                         * transactions to us at any time even
-                                         * though we can only execute them
-                                         * serially on the controller/device.
-                                         * This should remove some latency.
-                                         */
-                                        device->queue_depth = 2;
-                                }
-                        }
-                }
-        }
-        ahc_unlock(ahc, &flags);
+        ahc_linux_free_device(ahc, dev);
 }
-#endif
 
 #if defined(__i386__)
 /*
  * Return the disk geometry for the given SCSI device.
  */
 static int
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
 ahc_linux_biosparam(struct scsi_device *sdev, struct block_device *bdev,
                     sector_t capacity, int geom[])
 {
         uint8_t *bh;
-#else
-ahc_linux_biosparam(Disk *disk, kdev_t dev, int geom[])
-{
-        struct  scsi_device *sdev = disk->device;
-        u_long  capacity = disk->capacity;
-        struct  buffer_head *bh;
-#endif
         int      heads;
         int      sectors;
         int      cylinders;
@@ -1090,22 +774,11 @@ ahc_linux_biosparam(Disk *disk, kdev_t dev, int geom[])
         ahc = *((struct ahc_softc **)sdev->host->hostdata);
         channel = sdev->channel;
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
         bh = scsi_bios_ptable(bdev);
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,17)
-        bh = bread(MKDEV(MAJOR(dev), MINOR(dev) & ~0xf), 0, block_size(dev));
-#else
-        bh = bread(MKDEV(MAJOR(dev), MINOR(dev) & ~0xf), 0, 1024);
-#endif
-
         if (bh) {
                 ret = scsi_partsize(bh, capacity,
                                     &geom[2], &geom[0], &geom[1]);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
                 kfree(bh);
-#else
-                brelse(bh);
-#endif
                 if (ret != -1)
                         return (ret);
         }
@@ -1135,7 +808,7 @@ ahc_linux_biosparam(Disk *disk, kdev_t dev, int geom[])
  * Abort the current SCSI command(s).
  */
 static int
-ahc_linux_abort(Scsi_Cmnd *cmd)
+ahc_linux_abort(struct scsi_cmnd *cmd)
 {
         int error;
 
@@ -1149,7 +822,7 @@ ahc_linux_abort(Scsi_Cmnd *cmd)
  * Attempt to send a target reset message to the device that timed out.
  */
 static int
-ahc_linux_dev_reset(Scsi_Cmnd *cmd)
+ahc_linux_dev_reset(struct scsi_cmnd *cmd)
 {
         int error;
 
@@ -1163,18 +836,14 @@ ahc_linux_dev_reset(Scsi_Cmnd *cmd)
  * Reset the SCSI bus.
  */
 static int
-ahc_linux_bus_reset(Scsi_Cmnd *cmd)
+ahc_linux_bus_reset(struct scsi_cmnd *cmd)
 {
         struct ahc_softc *ahc;
-        u_long s;
         int    found;
 
         ahc = *(struct ahc_softc **)cmd->device->host->hostdata;
-        ahc_midlayer_entrypoint_lock(ahc, &s);
         found = ahc_reset_channel(ahc, cmd->device->channel + 'A',
                                   /*initiate reset*/TRUE);
-        ahc_linux_run_complete_queue(ahc);
-        ahc_midlayer_entrypoint_unlock(ahc, &s);
 
         if (bootverbose)
                 printf("%s: SCSI bus reset delivered. "
@@ -1183,7 +852,7 @@ ahc_linux_bus_reset(Scsi_Cmnd *cmd)
         return SUCCESS;
 }
 
-Scsi_Host_Template aic7xxx_driver_template = {
+struct scsi_host_template aic7xxx_driver_template = {
         .module                 = THIS_MODULE,
         .name                   = "aic7xxx",
         .proc_info              = ahc_linux_proc_info,
@@ -1206,33 +875,6 @@ Scsi_Host_Template aic7xxx_driver_template = {
 
 /**************************** Tasklet Handler *********************************/
 
-/*
- * In 2.4.X and above, this routine is called from a tasklet,
- * so we must re-acquire our lock prior to executing this code.
- * In all prior kernels, ahc_schedule_runq() calls this routine
- * directly and ahc_schedule_runq() is called with our lock held.
- */
-static void
-ahc_runq_tasklet(unsigned long data)
-{
-        struct ahc_softc* ahc;
-        struct ahc_linux_device *dev;
-        u_long flags;
-
-        ahc = (struct ahc_softc *)data;
-        ahc_lock(ahc, &flags);
-        while ((dev = ahc_linux_next_device_to_run(ahc)) != NULL) {
-        
-                TAILQ_REMOVE(&ahc->platform_data->device_runq, dev, links);
-                dev->flags &= ~AHC_DEV_ON_RUN_LIST;
-                ahc_linux_check_device_queue(ahc, dev);
-                /* Yeild to our interrupt handler */
-                ahc_unlock(ahc, &flags);
-                ahc_lock(ahc, &flags);
-        }
-        ahc_unlock(ahc, &flags);
-}
-
 /******************************** Macros **************************************/
 #define BUILD_SCSIID(ahc, cmd)                                              \
         ((((cmd)->device->id << TID_SHIFT) & TID)                           \
@@ -1278,37 +920,11 @@ int
 ahc_dmamem_alloc(struct ahc_softc *ahc, bus_dma_tag_t dmat, void** vaddr,
                  int flags, bus_dmamap_t *mapp)
 {
-        bus_dmamap_t map;
-
-        map = malloc(sizeof(*map), M_DEVBUF, M_NOWAIT);
-        if (map == NULL)
-                return (ENOMEM);
-        /*
-         * Although we can dma data above 4GB, our
-         * "consistent" memory is below 4GB for
-         * space efficiency reasons (only need a 4byte
-         * address).  For this reason, we have to reset
-         * our dma mask when doing allocations.
-         */
-        if (ahc->dev_softc != NULL)
-                if (pci_set_dma_mask(ahc->dev_softc, 0xFFFFFFFF)) {
-                        printk(KERN_WARNING "aic7xxx: No suitable DMA available.\n");
-                        kfree(map);
-                        return (ENODEV);
-                }
         *vaddr = pci_alloc_consistent(ahc->dev_softc,
-                                      dmat->maxsize, &map->bus_addr);
-        if (ahc->dev_softc != NULL)
-                if (pci_set_dma_mask(ahc->dev_softc,
-                                     ahc->platform_data->hw_dma_mask)) {
-                        printk(KERN_WARNING "aic7xxx: No suitable DMA available.\n");
-                        kfree(map);
-                        return (ENODEV);
-                }
+                                      dmat->maxsize, mapp);
         if (*vaddr == NULL)
-                return (ENOMEM);
-        *mapp = map;
-        return(0);
+                return ENOMEM;
+        return 0;
 }
 
 void
@@ -1316,7 +932,7 @@ ahc_dmamem_free(struct ahc_softc *ahc, bus_dma_tag_t dmat,
                 void* vaddr, bus_dmamap_t map)
 {
         pci_free_consistent(ahc->dev_softc, dmat->maxsize,
-                            vaddr, map->bus_addr);
+                            vaddr, map);
 }
 
 int
@@ -1330,7 +946,7 @@ ahc_dmamap_load(struct ahc_softc *ahc, bus_dma_tag_t dmat, bus_dmamap_t map,
          */
         bus_dma_segment_t stack_sg;
 
-        stack_sg.ds_addr = map->bus_addr;
+        stack_sg.ds_addr = map;
         stack_sg.ds_len = dmat->maxsize;
         cb(cb_arg, &stack_sg, /*nseg*/1, /*error*/0);
         return (0);
@@ -1339,12 +955,6 @@ ahc_dmamap_load(struct ahc_softc *ahc, bus_dma_tag_t dmat, bus_dmamap_t map,
 void
 ahc_dmamap_destroy(struct ahc_softc *ahc, bus_dma_tag_t dmat, bus_dmamap_t map)
 {
-        /*
-         * The map may is NULL in our < 2.3.X implementation.
-         * Now it's 2.6.5, but just in case...
-         */
-        BUG_ON(map == NULL);
-        free(map, M_DEVBUF);
 }
 
 int
@@ -1550,7 +1160,7 @@ __setup("aic7xxx=", aic7xxx_setup);
 uint32_t aic7xxx_verbose;
 
 int
-ahc_linux_register_host(struct ahc_softc *ahc, Scsi_Host_Template *template)
+ahc_linux_register_host(struct ahc_softc *ahc, struct scsi_host_template *template)
 {
         char     buf[80];
         struct   Scsi_Host *host;
@@ -1564,11 +1174,7 @@ ahc_linux_register_host(struct ahc_softc *ahc, Scsi_Host_Template *template)
 
         *((struct ahc_softc **)host->hostdata) = ahc;
         ahc_lock(ahc, &s);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
         scsi_assign_lock(host, &ahc->platform_data->spin_lock);
-#elif AHC_SCSI_HAS_HOST_LOCK != 0
-        host->lock = &ahc->platform_data->spin_lock;
-#endif
         ahc->platform_data->host = host;
         host->can_queue = AHC_MAX_QUEUE;
         host->cmd_per_lun = 2;
@@ -1587,19 +1193,14 @@ ahc_linux_register_host(struct ahc_softc *ahc, Scsi_Host_Template *template)
                 ahc_set_name(ahc, new_name);
         }
         host->unique_id = ahc->unit;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-        scsi_set_pci_device(host, ahc->dev_softc);
-#endif
         ahc_linux_initialize_scsi_bus(ahc);
         ahc_intr_enable(ahc, TRUE);
         ahc_unlock(ahc, &s);
 
         host->transportt = ahc_linux_transport_template;
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
         scsi_add_host(host, (ahc->dev_softc ? &ahc->dev_softc->dev : NULL)); /* XXX handle failure */
         scsi_scan_host(host);
-#endif
         return (0);
 }
 
@@ -1717,19 +1318,9 @@ ahc_platform_alloc(struct ahc_softc *ahc, void *platform_arg)
         if (ahc->platform_data == NULL)
                 return (ENOMEM);
         memset(ahc->platform_data, 0, sizeof(struct ahc_platform_data));
-        TAILQ_INIT(&ahc->platform_data->completeq);
-        TAILQ_INIT(&ahc->platform_data->device_runq);
         ahc->platform_data->irq = AHC_LINUX_NOIRQ;
-        ahc->platform_data->hw_dma_mask = 0xFFFFFFFF;
         ahc_lockinit(ahc);
-        ahc_done_lockinit(ahc);
-        init_timer(&ahc->platform_data->completeq_timer);
-        ahc->platform_data->completeq_timer.data = (u_long)ahc;
-        ahc->platform_data->completeq_timer.function =
-            (ahc_linux_callback_t *)ahc_linux_thread_run_complete_queue;
         init_MUTEX_LOCKED(&ahc->platform_data->eh_sem);
-        tasklet_init(&ahc->platform_data->runq_tasklet, ahc_runq_tasklet,
-                     (unsigned long)ahc);
         ahc->seltime = (aic7xxx_seltime & 0x3) << 4;
         ahc->seltime_b = (aic7xxx_seltime & 0x3) << 4;
         if (aic7xxx_pci_parity == 0)
@@ -1746,12 +1337,8 @@ ahc_platform_free(struct ahc_softc *ahc)
         int i, j;
 
         if (ahc->platform_data != NULL) {
-                del_timer_sync(&ahc->platform_data->completeq_timer);
-                tasklet_kill(&ahc->platform_data->runq_tasklet);
                 if (ahc->platform_data->host != NULL) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
                         scsi_remove_host(ahc->platform_data->host);
-#endif
                         scsi_host_put(ahc->platform_data->host);
                 }
 
@@ -1787,16 +1374,7 @@ ahc_platform_free(struct ahc_softc *ahc)
                         release_mem_region(ahc->platform_data->mem_busaddr,
                                            0x1000);
                 }
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-                /*
-                 * In 2.4 we detach from the scsi midlayer before the PCI
-                 * layer invokes our remove callback.  No per-instance
-                 * detach is provided, so we must reach inside the PCI
-                 * subsystem's internals and detach our driver manually.
-                 */
-                if (ahc->dev_softc != NULL)
-                        ahc->dev_softc->driver = NULL;
-#endif
+
                 free(ahc->platform_data, M_DEVBUF);
         }
 }
@@ -1820,7 +1398,7 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
 
         dev = ahc_linux_get_device(ahc, devinfo->channel - 'A',
                                    devinfo->target,
-                                   devinfo->lun, /*alloc*/FALSE);
+                                   devinfo->lun);
         if (dev == NULL)
                 return;
         was_queuing = dev->flags & (AHC_DEV_Q_BASIC|AHC_DEV_Q_TAGGED);
@@ -1873,7 +1451,6 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
                 dev->maxtags = 0;
                 dev->openings =  1 - dev->active;
         }
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
         if (dev->scsi_device != NULL) {
                 switch ((dev->flags & (AHC_DEV_Q_BASIC|AHC_DEV_Q_TAGGED))) {
                 case AHC_DEV_Q_BASIC:
@@ -1899,90 +1476,13 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
                         break;
                 }
         }
-#endif
 }
 
 int
 ahc_platform_abort_scbs(struct ahc_softc *ahc, int target, char channel,
                         int lun, u_int tag, role_t role, uint32_t status)
 {
-        int chan;
-        int maxchan;
-        int targ;
-        int maxtarg;
-        int clun;
-        int maxlun;
-        int count;
-
-        if (tag != SCB_LIST_NULL)
-                return (0);
-
-        chan = 0;
-        if (channel != ALL_CHANNELS) {
-                chan = channel - 'A';
-                maxchan = chan + 1;
-        } else {
-                maxchan = (ahc->features & AHC_TWIN) ? 2 : 1;
-        }
-        targ = 0;
-        if (target != CAM_TARGET_WILDCARD) {
-                targ = target;
-                maxtarg = targ + 1;
-        } else {
-                maxtarg = (ahc->features & AHC_WIDE) ? 16 : 8;
-        }
-        clun = 0;
-        if (lun != CAM_LUN_WILDCARD) {
-                clun = lun;
-                maxlun = clun + 1;
-        } else {
-                maxlun = AHC_NUM_LUNS;
-        }
-
-        count = 0;
-        for (; chan < maxchan; chan++) {
-
-                for (; targ < maxtarg; targ++) {
-
-                        for (; clun < maxlun; clun++) {
-                                struct ahc_linux_device *dev;
-                                struct ahc_busyq *busyq;
-                                struct ahc_cmd *acmd;
-
-                                dev = ahc_linux_get_device(ahc, chan,
-                                                           targ, clun,
-                                                           /*alloc*/FALSE);
-                                if (dev == NULL)
-                                        continue;
-
-                                busyq = &dev->busyq;
-                                while ((acmd = TAILQ_FIRST(busyq)) != NULL) {
-                                        Scsi_Cmnd *cmd;
-
-                                        cmd = &acmd_scsi_cmd(acmd);
-                                        TAILQ_REMOVE(busyq, acmd,
-                                                     acmd_links.tqe);
-                                        count++;
-                                        cmd->result = status << 16;
-                                        ahc_linux_queue_cmd_complete(ahc, cmd);
-                                }
-                        }
-                }
-        }
-
-        return (count);
-}
-
-static void
-ahc_linux_thread_run_complete_queue(struct ahc_softc *ahc)
-{
-        u_long flags;
-
-        ahc_lock(ahc, &flags);
-        del_timer(&ahc->platform_data->completeq_timer);
-        ahc->platform_data->flags &= ~AHC_RUN_CMPLT_Q_TIMER;
-        ahc_linux_run_complete_queue(ahc);
-        ahc_unlock(ahc, &flags);
+        return 0;
 }
 
 static u_int
@@ -2045,213 +1545,200 @@ ahc_linux_device_queue_depth(struct ahc_softc *ahc,
         }
 }
 
-static void
-ahc_linux_run_device_queue(struct ahc_softc *ahc, struct ahc_linux_device *dev)
+static int
+ahc_linux_run_command(struct ahc_softc *ahc, struct ahc_linux_device *dev,
+                      struct scsi_cmnd *cmd)
 {
-        struct   ahc_cmd *acmd;
-        struct   scsi_cmnd *cmd;
         struct   scb *scb;
         struct   hardware_scb *hscb;
         struct   ahc_initiator_tinfo *tinfo;
         struct   ahc_tmode_tstate *tstate;
         uint16_t mask;
+        struct scb_tailq *untagged_q = NULL;
 
-        if ((dev->flags & AHC_DEV_ON_RUN_LIST) != 0)
-                panic("running device on run list");
+        /*
+         * Schedule us to run later.  The only reason we are not
+         * running is because the whole controller Q is frozen.
+         */
+        if (ahc->platform_data->qfrozen != 0)
+                return SCSI_MLQUEUE_HOST_BUSY;
 
-        while ((acmd = TAILQ_FIRST(&dev->busyq)) != NULL
-            && dev->openings > 0 && dev->qfrozen == 0) {
+        /*
+         * We only allow one untagged transaction
+         * per target in the initiator role unless
+         * we are storing a full busy target *lun*
+         * table in SCB space.
+         */
+        if (!blk_rq_tagged(cmd->request)
+            && (ahc->features & AHC_SCB_BTT) == 0) {
+                int target_offset;
 
-                /*
-                 * Schedule us to run later.  The only reason we are not
-                 * running is because the whole controller Q is frozen.
-                 */
-                if (ahc->platform_data->qfrozen != 0) {
-                        TAILQ_INSERT_TAIL(&ahc->platform_data->device_runq,
-                                          dev, links);
-                        dev->flags |= AHC_DEV_ON_RUN_LIST;
-                        return;
-                }
-                /*
-                 * Get an scb to use.
-                 */
-                if ((scb = ahc_get_scb(ahc)) == NULL) {
-                        TAILQ_INSERT_TAIL(&ahc->platform_data->device_runq,
-                                         dev, links);
-                        dev->flags |= AHC_DEV_ON_RUN_LIST;
-                        ahc->flags |= AHC_RESOURCE_SHORTAGE;
-                        return;
-                }
-                TAILQ_REMOVE(&dev->busyq, acmd, acmd_links.tqe);
-                cmd = &acmd_scsi_cmd(acmd);
-                scb->io_ctx = cmd;
-                scb->platform_data->dev = dev;
-                hscb = scb->hscb;
-                cmd->host_scribble = (char *)scb;
+                target_offset = cmd->device->id + cmd->device->channel * 8;
+                untagged_q = &(ahc->untagged_queues[target_offset]);
+                if (!TAILQ_EMPTY(untagged_q))
+                        /* if we're already executing an untagged command
+                         * we're busy to another */
+                        return SCSI_MLQUEUE_DEVICE_BUSY;
+        }
 
-                /*
-                 * Fill out basics of the HSCB.
-                 */
-                hscb->control = 0;
-                hscb->scsiid = BUILD_SCSIID(ahc, cmd);
-                hscb->lun = cmd->device->lun;
-                mask = SCB_GET_TARGET_MASK(ahc, scb);
-                tinfo = ahc_fetch_transinfo(ahc, SCB_GET_CHANNEL(ahc, scb),
-                                            SCB_GET_OUR_ID(scb),
-                                            SCB_GET_TARGET(ahc, scb), &tstate);
-                hscb->scsirate = tinfo->scsirate;
-                hscb->scsioffset = tinfo->curr.offset;
-                if ((tstate->ultraenb & mask) != 0)
-                        hscb->control |= ULTRAENB;
-
-                if ((ahc->user_discenable & mask) != 0)
-                        hscb->control |= DISCENB;
-
-                if ((tstate->auto_negotiate & mask) != 0) {
-                        scb->flags |= SCB_AUTO_NEGOTIATE;
-                        scb->hscb->control |= MK_MESSAGE;
-                }
+        /*
+         * Get an scb to use.
+         */
+        if ((scb = ahc_get_scb(ahc)) == NULL) {
+                        ahc->flags |= AHC_RESOURCE_SHORTAGE;
+                        return SCSI_MLQUEUE_HOST_BUSY;
+        }
 
-                if ((dev->flags & (AHC_DEV_Q_TAGGED|AHC_DEV_Q_BASIC)) != 0) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
-                        int     msg_bytes;
-                        uint8_t tag_msgs[2];
+        scb->io_ctx = cmd;
+        scb->platform_data->dev = dev;
+        hscb = scb->hscb;
+        cmd->host_scribble = (char *)scb;
 
-                        msg_bytes = scsi_populate_tag_msg(cmd, tag_msgs);
-                        if (msg_bytes && tag_msgs[0] != MSG_SIMPLE_TASK) {
-                                hscb->control |= tag_msgs[0];
-                                if (tag_msgs[0] == MSG_ORDERED_TASK)
-                                        dev->commands_since_idle_or_otag = 0;
-                        } else
-#endif
-                        if (dev->commands_since_idle_or_otag == AHC_OTAG_THRESH
-                         && (dev->flags & AHC_DEV_Q_TAGGED) != 0) {
-                                hscb->control |= MSG_ORDERED_TASK;
+        /*
+         * Fill out basics of the HSCB.
+         */
+        hscb->control = 0;
+        hscb->scsiid = BUILD_SCSIID(ahc, cmd);
+        hscb->lun = cmd->device->lun;
+        mask = SCB_GET_TARGET_MASK(ahc, scb);
+        tinfo = ahc_fetch_transinfo(ahc, SCB_GET_CHANNEL(ahc, scb),
+                                    SCB_GET_OUR_ID(scb),
+                                    SCB_GET_TARGET(ahc, scb), &tstate);
+        hscb->scsirate = tinfo->scsirate;
+        hscb->scsioffset = tinfo->curr.offset;
+        if ((tstate->ultraenb & mask) != 0)
+                hscb->control |= ULTRAENB;
+        
+        if ((ahc->user_discenable & mask) != 0)
+                hscb->control |= DISCENB;
+        
+        if ((tstate->auto_negotiate & mask) != 0) {
+                scb->flags |= SCB_AUTO_NEGOTIATE;
+                scb->hscb->control |= MK_MESSAGE;
+        }
+
+        if ((dev->flags & (AHC_DEV_Q_TAGGED|AHC_DEV_Q_BASIC)) != 0) {
+                int     msg_bytes;
+                uint8_t tag_msgs[2];
+                
+                msg_bytes = scsi_populate_tag_msg(cmd, tag_msgs);
+                if (msg_bytes && tag_msgs[0] != MSG_SIMPLE_TASK) {
+                        hscb->control |= tag_msgs[0];
+                        if (tag_msgs[0] == MSG_ORDERED_TASK)
                                 dev->commands_since_idle_or_otag = 0;
-                        } else {
-                                hscb->control |= MSG_SIMPLE_TASK;
-                        }
-                }
-
-                hscb->cdb_len = cmd->cmd_len;
-                if (hscb->cdb_len <= 12) {
-                        memcpy(hscb->shared_data.cdb, cmd->cmnd, hscb->cdb_len);
+                } else if (dev->commands_since_idle_or_otag == AHC_OTAG_THRESH
+                                && (dev->flags & AHC_DEV_Q_TAGGED) != 0) {
+                        hscb->control |= MSG_ORDERED_TASK;
+                        dev->commands_since_idle_or_otag = 0;
                 } else {
-                        memcpy(hscb->cdb32, cmd->cmnd, hscb->cdb_len);
-                        scb->flags |= SCB_CDB32_PTR;
+                        hscb->control |= MSG_SIMPLE_TASK;
                 }
+        }
 
-                scb->platform_data->xfer_len = 0;
-                ahc_set_residual(scb, 0);
-                ahc_set_sense_residual(scb, 0);
-                scb->sg_count = 0;
-                if (cmd->use_sg != 0) {
-                        struct  ahc_dma_seg *sg;
-                        struct  scatterlist *cur_seg;
-                        struct  scatterlist *end_seg;
-                        int     nseg;
-
-                        cur_seg = (struct scatterlist *)cmd->request_buffer;
-                        nseg = pci_map_sg(ahc->dev_softc, cur_seg, cmd->use_sg,
-                            cmd->sc_data_direction);
-                        end_seg = cur_seg + nseg;
-                        /* Copy the segments into the SG list. */
-                        sg = scb->sg_list;
-                        /*
-                         * The sg_count may be larger than nseg if
-                         * a transfer crosses a 32bit page.
-                         */ 
-                        while (cur_seg < end_seg) {
-                                dma_addr_t addr;
-                                bus_size_t len;
-                                int consumed;
-
-                                addr = sg_dma_address(cur_seg);
-                                len = sg_dma_len(cur_seg);
-                                consumed = ahc_linux_map_seg(ahc, scb,
-                                                             sg, addr, len);
-                                sg += consumed;
-                                scb->sg_count += consumed;
-                                cur_seg++;
-                        }
-                        sg--;
-                        sg->len |= ahc_htole32(AHC_DMA_LAST_SEG);
-
-                        /*
-                         * Reset the sg list pointer.
-                         */
-                        scb->hscb->sgptr =
-                            ahc_htole32(scb->sg_list_phys | SG_FULL_RESID);
+        hscb->cdb_len = cmd->cmd_len;
+        if (hscb->cdb_len <= 12) {
+                memcpy(hscb->shared_data.cdb, cmd->cmnd, hscb->cdb_len);
+        } else {
+                memcpy(hscb->cdb32, cmd->cmnd, hscb->cdb_len);
+                scb->flags |= SCB_CDB32_PTR;
+        }
 
-                        /*
-                         * Copy the first SG into the "current"
-                         * data pointer area.
-                         */
-                        scb->hscb->dataptr = scb->sg_list->addr;
-                        scb->hscb->datacnt = scb->sg_list->len;
-                } else if (cmd->request_bufflen != 0) {
-                        struct   ahc_dma_seg *sg;
+        scb->platform_data->xfer_len = 0;
+        ahc_set_residual(scb, 0);
+        ahc_set_sense_residual(scb, 0);
+        scb->sg_count = 0;
+        if (cmd->use_sg != 0) {
+                struct  ahc_dma_seg *sg;
+                struct  scatterlist *cur_seg;
+                struct  scatterlist *end_seg;
+                int     nseg;
+
+                cur_seg = (struct scatterlist *)cmd->request_buffer;
+                nseg = pci_map_sg(ahc->dev_softc, cur_seg, cmd->use_sg,
+                                  cmd->sc_data_direction);
+                end_seg = cur_seg + nseg;
+                /* Copy the segments into the SG list. */
+                sg = scb->sg_list;
+                /*
+                 * The sg_count may be larger than nseg if
+                 * a transfer crosses a 32bit page.
+                 */ 
+                while (cur_seg < end_seg) {
                         dma_addr_t addr;
-
-                        sg = scb->sg_list;
-                        addr = pci_map_single(ahc->dev_softc,
-                               cmd->request_buffer,
-                               cmd->request_bufflen,
-                               cmd->sc_data_direction);
-                        scb->platform_data->buf_busaddr = addr;
-                        scb->sg_count = ahc_linux_map_seg(ahc, scb,
-                                                          sg, addr,
-                                                          cmd->request_bufflen);
-                        sg->len |= ahc_htole32(AHC_DMA_LAST_SEG);
-
-                        /*
-                         * Reset the sg list pointer.
-                         */
-                        scb->hscb->sgptr =
-                            ahc_htole32(scb->sg_list_phys | SG_FULL_RESID);
-
-                        /*
-                         * Copy the first SG into the "current"
-                         * data pointer area.
-                         */
-                        scb->hscb->dataptr = sg->addr;
-                        scb->hscb->datacnt = sg->len;
-                } else {
-                        scb->hscb->sgptr = ahc_htole32(SG_LIST_NULL);
-                        scb->hscb->dataptr = 0;
-                        scb->hscb->datacnt = 0;
-                        scb->sg_count = 0;
+                        bus_size_t len;
+                        int consumed;
+
+                        addr = sg_dma_address(cur_seg);
+                        len = sg_dma_len(cur_seg);
+                        consumed = ahc_linux_map_seg(ahc, scb,
+                                                     sg, addr, len);
+                        sg += consumed;
+                        scb->sg_count += consumed;
+                        cur_seg++;
                 }
+                sg--;
+                sg->len |= ahc_htole32(AHC_DMA_LAST_SEG);
 
-                ahc_sync_sglist(ahc, scb, BUS_DMASYNC_PREWRITE);
-                LIST_INSERT_HEAD(&ahc->pending_scbs, scb, pending_links);
-                dev->openings--;
-                dev->active++;
-                dev->commands_issued++;
-                if ((dev->flags & AHC_DEV_PERIODIC_OTAG) != 0)
-                        dev->commands_since_idle_or_otag++;
+                /*
+                 * Reset the sg list pointer.
+                 */
+                scb->hscb->sgptr =
+                        ahc_htole32(scb->sg_list_phys | SG_FULL_RESID);
+                
+                /*
+                 * Copy the first SG into the "current"
+                 * data pointer area.
+                 */
+                scb->hscb->dataptr = scb->sg_list->addr;
+                scb->hscb->datacnt = scb->sg_list->len;
+        } else if (cmd->request_bufflen != 0) {
+                struct   ahc_dma_seg *sg;
+                dma_addr_t addr;
+
+                sg = scb->sg_list;
+                addr = pci_map_single(ahc->dev_softc,
+                                      cmd->request_buffer,
+                                      cmd->request_bufflen,
+                                      cmd->sc_data_direction);
+                scb->platform_data->buf_busaddr = addr;
+                scb->sg_count = ahc_linux_map_seg(ahc, scb,
+                                                  sg, addr,
+                                                  cmd->request_bufflen);
+                sg->len |= ahc_htole32(AHC_DMA_LAST_SEG);
 
                 /*
-                 * We only allow one untagged transaction
-                 * per target in the initiator role unless
-                 * we are storing a full busy target *lun*
-                 * table in SCB space.
+                 * Reset the sg list pointer.
                  */
-                if ((scb->hscb->control & (TARGET_SCB|TAG_ENB)) == 0
-                 && (ahc->features & AHC_SCB_BTT) == 0) {
-                        struct scb_tailq *untagged_q;
-                        int target_offset;
-
-                        target_offset = SCB_GET_TARGET_OFFSET(ahc, scb);
-                        untagged_q = &(ahc->untagged_queues[target_offset]);
-                        TAILQ_INSERT_TAIL(untagged_q, scb, links.tqe);
-                        scb->flags |= SCB_UNTAGGEDQ;
-                        if (TAILQ_FIRST(untagged_q) != scb)
-                                continue;
-                }
-                scb->flags |= SCB_ACTIVE;
-                ahc_queue_scb(ahc, scb);
+                scb->hscb->sgptr =
+                        ahc_htole32(scb->sg_list_phys | SG_FULL_RESID);
+
+                /*
+                 * Copy the first SG into the "current"
+                 * data pointer area.
+                 */
+                scb->hscb->dataptr = sg->addr;
+                scb->hscb->datacnt = sg->len;
+        } else {
+                scb->hscb->sgptr = ahc_htole32(SG_LIST_NULL);
+                scb->hscb->dataptr = 0;
+                scb->hscb->datacnt = 0;
+                scb->sg_count = 0;
         }
+
+        LIST_INSERT_HEAD(&ahc->pending_scbs, scb, pending_links);
+        dev->openings--;
+        dev->active++;
+        dev->commands_issued++;
+        if ((dev->flags & AHC_DEV_PERIODIC_OTAG) != 0)
+                dev->commands_since_idle_or_otag++;
+        
+        scb->flags |= SCB_ACTIVE;
+        if (untagged_q) {
+                TAILQ_INSERT_TAIL(untagged_q, scb, links.tqe);
+                scb->flags |= SCB_UNTAGGEDQ;
+        }
+        ahc_queue_scb(ahc, scb);
+        return 0;
 }
 
 /*
@@ -2267,9 +1754,6 @@ ahc_linux_isr(int irq, void *dev_id, struct pt_regs * regs)
         ahc = (struct ahc_softc *) dev_id;
         ahc_lock(ahc, &flags); 
         ours = ahc_intr(ahc);
-        if (ahc_linux_next_device_to_run(ahc) != NULL)
-                ahc_schedule_runq(ahc);
-        ahc_linux_run_complete_queue(ahc);
         ahc_unlock(ahc, &flags);
         return IRQ_RETVAL(ours);
 }
@@ -2278,8 +1762,6 @@ void
 ahc_platform_flushwork(struct ahc_softc *ahc)
 {
 
-        while (ahc_linux_run_complete_queue(ahc) != NULL)
-                ;
 }
 
 static struct ahc_linux_target*
@@ -2335,8 +1817,6 @@ ahc_linux_free_target(struct ahc_softc *ahc, struct ahc_linux_target *targ)
                       AHC_TRANS_GOAL, /*paused*/FALSE);
         ahc_update_neg_request(ahc, &devinfo, tstate, tinfo, AHC_NEG_ALWAYS);
         ahc->platform_data->targets[target_offset] = NULL;
-        if (targ->inq_data != NULL)
-                free(targ->inq_data, M_DEVBUF);
         free(targ, M_DEVBUF);
 }
 
@@ -2350,9 +1830,6 @@ ahc_linux_alloc_device(struct ahc_softc *ahc,
         if (dev == NULL)
                 return (NULL);
         memset(dev, 0, sizeof(*dev));
-        init_timer(&dev->timer);
-        TAILQ_INIT(&dev->busyq);
-        dev->flags = AHC_DEV_UNCONFIGURED;
         dev->lun = lun;
         dev->target = targ;
 
@@ -2375,7 +1852,7 @@ ahc_linux_alloc_device(struct ahc_softc *ahc,
 }
 
 static void
-__ahc_linux_free_device(struct ahc_softc *ahc, struct ahc_linux_device *dev)
+ahc_linux_free_device(struct ahc_softc *ahc, struct ahc_linux_device *dev)
 {
         struct ahc_linux_target *targ;
 
@@ -2387,13 +1864,6 @@ __ahc_linux_free_device(struct ahc_softc *ahc, struct ahc_linux_device *dev)
                 ahc_linux_free_target(ahc, targ);
 }
 
-static void
-ahc_linux_free_device(struct ahc_softc *ahc, struct ahc_linux_device *dev)
-{
-        del_timer_sync(&dev->timer);
-        __ahc_linux_free_device(ahc, dev);
-}
-
 void
 ahc_send_async(struct ahc_softc *ahc, char channel,
                u_int target, u_int lun, ac_code code, void *arg)
@@ -2465,28 +1935,9 @@ ahc_send_async(struct ahc_softc *ahc, char channel,
         }
         case AC_SENT_BDR:
         {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
                 WARN_ON(lun != CAM_LUN_WILDCARD);
                 scsi_report_device_reset(ahc->platform_data->host,
                                          channel - 'A', target);
-#else
-                Scsi_Device *scsi_dev;
-
-                /*
-                 * Find the SCSI device associated with this
-                 * request and indicate that a UA is expected.
-                 */
-                for (scsi_dev = ahc->platform_data->host->host_queue;
-                     scsi_dev != NULL; scsi_dev = scsi_dev->next) {
-                        if (channel - 'A' == scsi_dev->channel
-                         && target == scsi_dev->id
-                         && (lun == CAM_LUN_WILDCARD
-                          || lun == scsi_dev->lun)) {
-                                scsi_dev->was_reset = 1;
-                                scsi_dev->expecting_cc_ua = 1;
-                        }
-                }
-#endif
                 break;
         }
         case AC_BUS_RESET:
@@ -2506,7 +1957,7 @@ ahc_send_async(struct ahc_softc *ahc, char channel,
 void
 ahc_done(struct ahc_softc *ahc, struct scb *scb)
 {
-        Scsi_Cmnd *cmd;
+        struct scsi_cmnd *cmd;
         struct     ahc_linux_device *dev;
 
         LIST_REMOVE(scb, pending_links);
@@ -2517,7 +1968,7 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
                 target_offset = SCB_GET_TARGET_OFFSET(ahc, scb);
                 untagged_q = &(ahc->untagged_queues[target_offset]);
                 TAILQ_REMOVE(untagged_q, scb, links.tqe);
-                ahc_run_untagged_queue(ahc, untagged_q);
+                BUG_ON(!TAILQ_EMPTY(untagged_q));
         }
 
         if ((scb->flags & SCB_ACTIVE) == 0) {
@@ -2585,8 +2036,6 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
                 }
         } else if (ahc_get_transaction_status(scb) == CAM_SCSI_STATUS_ERROR) {
                 ahc_linux_handle_scsi_status(ahc, dev, scb);
-        } else if (ahc_get_transaction_status(scb) == CAM_SEL_TIMEOUT) {
-                dev->flags |= AHC_DEV_UNCONFIGURED;
         }
 
         if (dev->openings == 1
@@ -2608,16 +2057,6 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
         if (dev->active == 0)
                 dev->commands_since_idle_or_otag = 0;
 
-        if (TAILQ_EMPTY(&dev->busyq)) {
-                if ((dev->flags & AHC_DEV_UNCONFIGURED) != 0
-                 && dev->active == 0
-                 && (dev->flags & AHC_DEV_TIMER_ACTIVE) == 0)
-                        ahc_linux_free_device(ahc, dev);
-        } else if ((dev->flags & AHC_DEV_ON_RUN_LIST) == 0) {
-                TAILQ_INSERT_TAIL(&ahc->platform_data->device_runq, dev, links);
-                dev->flags |= AHC_DEV_ON_RUN_LIST;
-        }
-
         if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
                 printf("Recovery SCB completes\n");
                 if (ahc_get_transaction_status(scb) == CAM_BDR_SENT
@@ -2661,7 +2100,7 @@ ahc_linux_handle_scsi_status(struct ahc_softc *ahc,
         case SCSI_STATUS_CHECK_COND:
         case SCSI_STATUS_CMD_TERMINATED:
         {
-                Scsi_Cmnd *cmd;
+                struct scsi_cmnd *cmd;
 
                 /*
                  * Copy sense information to the OS's cmd
@@ -2756,52 +2195,15 @@ ahc_linux_handle_scsi_status(struct ahc_softc *ahc,
                 ahc_platform_set_tags(ahc, &devinfo,
                              (dev->flags & AHC_DEV_Q_BASIC)
                            ? AHC_QUEUE_BASIC : AHC_QUEUE_TAGGED);
-                /* FALLTHROUGH */
-        }
-        case SCSI_STATUS_BUSY:
-        {
-                /*
-                 * Set a short timer to defer sending commands for
-                 * a bit since Linux will not delay in this case.
-                 */
-                if ((dev->flags & AHC_DEV_TIMER_ACTIVE) != 0) {
-                        printf("%s:%c:%d: Device Timer still active during "
-                               "busy processing\n", ahc_name(ahc),
-                                dev->target->channel, dev->target->target);
-                        break;
-                }
-                dev->flags |= AHC_DEV_TIMER_ACTIVE;
-                dev->qfrozen++;
-                init_timer(&dev->timer);
-                dev->timer.data = (u_long)dev;
-                dev->timer.expires = jiffies + (HZ/2);
-                dev->timer.function = ahc_linux_dev_timed_unfreeze;
-                add_timer(&dev->timer);
                 break;
         }
         }
 }
 
 static void
-ahc_linux_queue_cmd_complete(struct ahc_softc *ahc, Scsi_Cmnd *cmd)
+ahc_linux_queue_cmd_complete(struct ahc_softc *ahc, struct scsi_cmnd *cmd)
 {
         /*
-         * Typically, the complete queue has very few entries
-         * queued to it before the queue is emptied by
-         * ahc_linux_run_complete_queue, so sorting the entries
-         * by generation number should be inexpensive.
-         * We perform the sort so that commands that complete
-         * with an error are retuned in the order origionally
-         * queued to the controller so that any subsequent retries
-         * are performed in order.  The underlying ahc routines do
-         * not guarantee the order that aborted commands will be
-         * returned to us.
-         */
-        struct ahc_completeq *completeq;
-        struct ahc_cmd *list_cmd;
-        struct ahc_cmd *acmd;
-
-        /*
          * Map CAM error codes into Linux Error codes.  We
          * avoid the conversion so that the DV code has the
          * full error information available when making
@@ -2854,26 +2256,7 @@ ahc_linux_queue_cmd_complete(struct ahc_softc *ahc, Scsi_Cmnd *cmd)
                         new_status = DID_ERROR;
                         break;
                 case CAM_REQUEUE_REQ:
-                        /*
-                         * If we want the request requeued, make sure there
-                         * are sufficent retries.  In the old scsi error code,
-                         * we used to be able to specify a result code that
-                         * bypassed the retry count.  Now we must use this
-                         * hack.  We also "fake" a check condition with
-                         * a sense code of ABORTED COMMAND.  This seems to
-                         * evoke a retry even if this command is being sent
-                         * via the eh thread.  Ick!  Ick!  Ick!
-                         */
-                        if (cmd->retries > 0)
-                                cmd->retries--;
-                        new_status = DID_OK;
-                        ahc_cmd_set_scsi_status(cmd, SCSI_STATUS_CHECK_COND);
-                        cmd->result |= (DRIVER_SENSE << 24);
-                        memset(cmd->sense_buffer, 0,
-                               sizeof(cmd->sense_buffer));
-                        cmd->sense_buffer[0] = SSD_ERRCODE_VALID
-                                             | SSD_CURRENT_ERROR;
-                        cmd->sense_buffer[2] = SSD_KEY_ABORTED_COMMAND;
+                        new_status = DID_REQUEUE;
                         break;
                 default:
                         /* We should never get here */
@@ -2884,17 +2267,7 @@ ahc_linux_queue_cmd_complete(struct ahc_softc *ahc, Scsi_Cmnd *cmd)
                 ahc_cmd_set_transaction_status(cmd, new_status);
         }
 
-        completeq = &ahc->platform_data->completeq;
-        list_cmd = TAILQ_FIRST(completeq);
-        acmd = (struct ahc_cmd *)cmd;
-        while (list_cmd != NULL
-            && acmd_scsi_cmd(list_cmd).serial_number
-             < acmd_scsi_cmd(acmd).serial_number)
-                list_cmd = TAILQ_NEXT(list_cmd, acmd_links.tqe);
-        if (list_cmd != NULL)
-                TAILQ_INSERT_BEFORE(list_cmd, acmd, acmd_links.tqe);
-        else
-                TAILQ_INSERT_TAIL(completeq, acmd, acmd_links.tqe);
+        cmd->scsi_done(cmd);
 }
 
 static void
@@ -2942,7 +2315,6 @@ ahc_linux_release_simq(u_long arg)
                 ahc->platform_data->qfrozen--;
         if (ahc->platform_data->qfrozen == 0)
                 unblock_reqs = 1;
-        ahc_schedule_runq(ahc);
         ahc_unlock(ahc, &s);
         /*
          * There is still a race here.  The mid-layer
@@ -2954,37 +2326,12 @@ ahc_linux_release_simq(u_long arg)
                 scsi_unblock_requests(ahc->platform_data->host);
 }
 
-static void
-ahc_linux_dev_timed_unfreeze(u_long arg)
-{
-        struct ahc_linux_device *dev;
-        struct ahc_softc *ahc;
-        u_long s;
-
-        dev = (struct ahc_linux_device *)arg;
-        ahc = dev->target->ahc;
-        ahc_lock(ahc, &s);
-        dev->flags &= ~AHC_DEV_TIMER_ACTIVE;
-        if (dev->qfrozen > 0)
-                dev->qfrozen--;
-        if (dev->qfrozen == 0
-         && (dev->flags & AHC_DEV_ON_RUN_LIST) == 0)
-                ahc_linux_run_device_queue(ahc, dev);
-        if (TAILQ_EMPTY(&dev->busyq)
-         && dev->active == 0)
-                __ahc_linux_free_device(ahc, dev);
-        ahc_unlock(ahc, &s);
-}
-
 static int
-ahc_linux_queue_recovery_cmd(Scsi_Cmnd *cmd, scb_flag flag)
+ahc_linux_queue_recovery_cmd(struct scsi_cmnd *cmd, scb_flag flag)
 {
         struct ahc_softc *ahc;
-        struct ahc_cmd *acmd;
-        struct ahc_cmd *list_acmd;
         struct ahc_linux_device *dev;
         struct scb *pending_scb;
-        u_long s;
         u_int  saved_scbptr;
         u_int  active_scb_index;
         u_int  last_phase;
@@ -3000,7 +2347,6 @@ ahc_linux_queue_recovery_cmd(Scsi_Cmnd *cmd, scb_flag flag)
         paused = FALSE;
         wait = FALSE;
         ahc = *(struct ahc_softc **)cmd->device->host->hostdata;
-        acmd = (struct ahc_cmd *)cmd;
 
         printf("%s:%d:%d:%d: Attempting to queue a%s message\n",
                ahc_name(ahc), cmd->device->channel,
@@ -3013,22 +2359,6 @@ ahc_linux_queue_recovery_cmd(Scsi_Cmnd *cmd, scb_flag flag)
         printf("\n");
 
         /*
-         * In all versions of Linux, we have to work around
-         * a major flaw in how the mid-layer is locked down
-         * if we are to sleep successfully in our error handler
-         * while allowing our interrupt handler to run.  Since
-         * the midlayer acquires either the io_request_lock or
-         * our lock prior to calling us, we must use the
-         * spin_unlock_irq() method for unlocking our lock.
-         * This will force interrupts to be enabled on the
-         * current CPU.  Since the EH thread should not have
-         * been running with CPU interrupts disabled other than
-         * by acquiring either the io_request_lock or our own
-         * lock, this *should* be safe.
-         */
-        ahc_midlayer_entrypoint_lock(ahc, &s);
-
-        /*
          * First determine if we currently own this command.
          * Start by searching the device queue.  If not found
          * there, check the pending_scb list.  If not found
@@ -3036,7 +2366,7 @@ ahc_linux_queue_recovery_cmd(Scsi_Cmnd *cmd, scb_flag flag)
          * command, return success.
          */
         dev = ahc_linux_get_device(ahc, cmd->device->channel, cmd->device->id,
-                                   cmd->device->lun, /*alloc*/FALSE);
+                                   cmd->device->lun);
 
         if (dev == NULL) {
                 /*
@@ -3050,24 +2380,6 @@ ahc_linux_queue_recovery_cmd(Scsi_Cmnd *cmd, scb_flag flag)
                 goto no_cmd;
         }
 
-        TAILQ_FOREACH(list_acmd, &dev->busyq, acmd_links.tqe) {
-                if (list_acmd == acmd)
-                        break;
-        }
-
-        if (list_acmd != NULL) {
-                printf("%s:%d:%d:%d: Command found on device queue\n",
-                       ahc_name(ahc), cmd->device->channel, cmd->device->id,
-                       cmd->device->lun);
-                if (flag == SCB_ABORT) {
-                        TAILQ_REMOVE(&dev->busyq, list_acmd, acmd_links.tqe);
-                        cmd->result = DID_ABORT << 16;
-                        ahc_linux_queue_cmd_complete(ahc, cmd);
-                        retval = SUCCESS;
-                        goto done;
-                }
-        }
-
         if ((dev->flags & (AHC_DEV_Q_BASIC|AHC_DEV_Q_TAGGED)) == 0
          && ahc_search_untagged_queues(ahc, cmd, cmd->device->id,
                                        cmd->device->channel + 'A',
@@ -3301,53 +2613,42 @@ done:
                 }
                 spin_lock_irq(&ahc->platform_data->spin_lock);
         }
-        ahc_schedule_runq(ahc);
-        ahc_linux_run_complete_queue(ahc);
-        ahc_midlayer_entrypoint_unlock(ahc, &s);
         return (retval);
 }
 
 void
 ahc_platform_dump_card_state(struct ahc_softc *ahc)
 {
-        struct ahc_linux_device *dev;
-        int channel;
-        int maxchannel;
-        int target;
-        int maxtarget;
-        int lun;
-        int i;
-
-        maxchannel = (ahc->features & AHC_TWIN) ? 1 : 0;
-        maxtarget = (ahc->features & AHC_WIDE) ? 15 : 7;
-        for (channel = 0; channel <= maxchannel; channel++) {
+}
 
-                for (target = 0; target <=maxtarget; target++) {
+static void ahc_linux_exit(void);
 
-                        for (lun = 0; lun < AHC_NUM_LUNS; lun++) {
-                                struct ahc_cmd *acmd;
+static void ahc_linux_get_width(struct scsi_target *starget)
+{
+        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        struct ahc_softc *ahc = *((struct ahc_softc **)shost->hostdata);
+        struct ahc_tmode_tstate *tstate;
+        struct ahc_initiator_tinfo *tinfo 
+                = ahc_fetch_transinfo(ahc,
+                                      starget->channel + 'A',
+                                      shost->this_id, starget->id, &tstate);
+        spi_width(starget) = tinfo->curr.width;
+}
 
-                                dev = ahc_linux_get_device(ahc, channel, target,
-                                                           lun, /*alloc*/FALSE);
-                                if (dev == NULL)
-                                        continue;
+static void ahc_linux_set_width(struct scsi_target *starget, int width)
+{
+        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        struct ahc_softc *ahc = *((struct ahc_softc **)shost->hostdata);
+        struct ahc_devinfo devinfo;
+        unsigned long flags;
 
-                                printf("DevQ(%d:%d:%d): ",
-                                       channel, target, lun);
-                                i = 0;
-                                TAILQ_FOREACH(acmd, &dev->busyq,
-                                              acmd_links.tqe) {
-                                        if (i++ > AHC_SCB_MAX)
-                                                break;
-                                }
-                                printf("%d waiting\n", i);
-                        }
-                }
-        }
+        ahc_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
+                            starget->channel + 'A', ROLE_INITIATOR);
+        ahc_lock(ahc, &flags);
+        ahc_set_width(ahc, &devinfo, width, AHC_TRANS_GOAL, FALSE);
+        ahc_unlock(ahc, &flags);
 }
 
-static void ahc_linux_exit(void);
-
 static void ahc_linux_get_period(struct scsi_target *starget)
 {
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
@@ -3378,8 +2679,21 @@ static void ahc_linux_set_period(struct scsi_target *starget, int period)
         if (offset == 0)
                 offset = MAX_OFFSET;
 
+        if (period < 9)
+                period = 9;     /* 12.5ns is our minimum */
+        if (period == 9)
+                ppr_options |= MSG_EXT_PPR_DT_REQ;
+
         ahc_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
                             starget->channel + 'A', ROLE_INITIATOR);
+
+        /* all PPR requests apart from QAS require wide transfers */
+        if (ppr_options & ~MSG_EXT_PPR_QAS_REQ) {
+                ahc_linux_get_width(starget);
+                if (spi_width(starget) == 0)
+                        ppr_options &= MSG_EXT_PPR_QAS_REQ;
+        }
+
         syncrate = ahc_find_syncrate(ahc, &period, &ppr_options, AHC_SYNCRATE_DT);
         ahc_lock(ahc, &flags);
         ahc_set_syncrate(ahc, &devinfo, syncrate, period, offset,
@@ -3427,32 +2741,6 @@ static void ahc_linux_set_offset(struct scsi_target *starget, int offset)
         ahc_unlock(ahc, &flags);
 }
 
-static void ahc_linux_get_width(struct scsi_target *starget)
-{
-        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
-        struct ahc_softc *ahc = *((struct ahc_softc **)shost->hostdata);
-        struct ahc_tmode_tstate *tstate;
-        struct ahc_initiator_tinfo *tinfo 
-                = ahc_fetch_transinfo(ahc,
-                                      starget->channel + 'A',
-                                      shost->this_id, starget->id, &tstate);
-        spi_width(starget) = tinfo->curr.width;
-}
-
-static void ahc_linux_set_width(struct scsi_target *starget, int width)
-{
-        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
-        struct ahc_softc *ahc = *((struct ahc_softc **)shost->hostdata);
-        struct ahc_devinfo devinfo;
-        unsigned long flags;
-
-        ahc_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
-                            starget->channel + 'A', ROLE_INITIATOR);
-        ahc_lock(ahc, &flags);
-        ahc_set_width(ahc, &devinfo, width, AHC_TRANS_GOAL, FALSE);
-        ahc_unlock(ahc, &flags);
-}
-
 static void ahc_linux_get_dt(struct scsi_target *starget)
 {
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
@@ -3481,10 +2769,15 @@ static void ahc_linux_set_dt(struct scsi_target *starget, int dt)
         unsigned long flags;
         struct ahc_syncrate *syncrate;
 
+        if (dt) {
+                period = 9;     /* 12.5ns is the only period valid for DT */
+                ppr_options |= MSG_EXT_PPR_DT_REQ;
+        } else if (period == 9)
+                period = 10;    /* if resetting DT, period must be >= 25ns */
+
         ahc_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
                             starget->channel + 'A', ROLE_INITIATOR);
-        syncrate = ahc_find_syncrate(ahc, &period, &ppr_options,
-                                     dt ? AHC_SYNCRATE_DT : AHC_SYNCRATE_ULTRA2);
+        syncrate = ahc_find_syncrate(ahc, &period, &ppr_options,AHC_SYNCRATE_DT);
         ahc_lock(ahc, &flags);
         ahc_set_syncrate(ahc, &devinfo, syncrate, period, tinfo->curr.offset,
                          ppr_options, AHC_TRANS_GOAL, FALSE);
@@ -3516,7 +2809,6 @@ static void ahc_linux_set_qas(struct scsi_target *starget, int qas)
         unsigned int ppr_options = tinfo->curr.ppr_options
                 & ~MSG_EXT_PPR_QAS_REQ;
         unsigned int period = tinfo->curr.period;
-        unsigned int dt = ppr_options & MSG_EXT_PPR_DT_REQ;
         unsigned long flags;
         struct ahc_syncrate *syncrate;
 
@@ -3525,8 +2817,7 @@ static void ahc_linux_set_qas(struct scsi_target *starget, int qas)
 
         ahc_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
                             starget->channel + 'A', ROLE_INITIATOR);
-        syncrate = ahc_find_syncrate(ahc, &period, &ppr_options,
-                                     dt ? AHC_SYNCRATE_DT : AHC_SYNCRATE_ULTRA2);
+        syncrate = ahc_find_syncrate(ahc, &period, &ppr_options, AHC_SYNCRATE_DT);
         ahc_lock(ahc, &flags);
         ahc_set_syncrate(ahc, &devinfo, syncrate, period, tinfo->curr.offset,
                          ppr_options, AHC_TRANS_GOAL, FALSE);
@@ -3558,7 +2849,6 @@ static void ahc_linux_set_iu(struct scsi_target *starget, int iu)
         unsigned int ppr_options = tinfo->curr.ppr_options
                 & ~MSG_EXT_PPR_IU_REQ;
         unsigned int period = tinfo->curr.period;
-        unsigned int dt = ppr_options & MSG_EXT_PPR_DT_REQ;
         unsigned long flags;
         struct ahc_syncrate *syncrate;
 
@@ -3567,8 +2857,7 @@ static void ahc_linux_set_iu(struct scsi_target *starget, int iu)
 
         ahc_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
                             starget->channel + 'A', ROLE_INITIATOR);
-        syncrate = ahc_find_syncrate(ahc, &period, &ppr_options,
-                                     dt ? AHC_SYNCRATE_DT : AHC_SYNCRATE_ULTRA2);
+        syncrate = ahc_find_syncrate(ahc, &period, &ppr_options, AHC_SYNCRATE_DT);
         ahc_lock(ahc, &flags);
         ahc_set_syncrate(ahc, &devinfo, syncrate, period, tinfo->curr.offset,
                          ppr_options, AHC_TRANS_GOAL, FALSE);
@@ -3601,7 +2890,6 @@ static struct spi_function_template ahc_linux_transport_functions = {
 static int __init
 ahc_linux_init(void)
 {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
         ahc_linux_transport_template = spi_attach_transport(&ahc_linux_transport_functions);
         if (!ahc_linux_transport_template)
                 return -ENODEV;
@@ -3610,29 +2898,11 @@ ahc_linux_init(void)
         spi_release_transport(ahc_linux_transport_template);
         ahc_linux_exit();
         return -ENODEV;
-#else
-        scsi_register_module(MODULE_SCSI_HA, &aic7xxx_driver_template);
-        if (aic7xxx_driver_template.present == 0) {
-                scsi_unregister_module(MODULE_SCSI_HA,
-                                       &aic7xxx_driver_template);
-                return (-ENODEV);
-        }
-
-        return (0);
-#endif
 }
 
 static void
 ahc_linux_exit(void)
 {
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-        /*
-         * In 2.4 we have to unregister from the PCI core _after_
-         * unregistering from the scsi midlayer to avoid dangling
-         * references.
-         */
-        scsi_unregister_module(MODULE_SCSI_HA, &aic7xxx_driver_template);
-#endif
         ahc_linux_pci_exit();
         ahc_linux_eisa_exit();
         spi_release_transport(ahc_linux_transport_template);
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.h b/drivers/scsi/aic7xxx/aic7xxx_osm.h
index c401537067b6..30c200d5bcd5 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.h
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.h
@@ -59,6 +59,7 @@
 #ifndef _AIC7XXX_LINUX_H_
 #define _AIC7XXX_LINUX_H_
 
+#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/blkdev.h>
 #include <linux/delay.h>
@@ -66,18 +67,21 @@
 #include <linux/pci.h>
 #include <linux/smp_lock.h>
 #include <linux/version.h>
+#include <linux/interrupt.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/byteorder.h>
 #include <asm/io.h>
 
-#include <linux/interrupt.h> /* For tasklet support. */
-#include <linux/config.h>
-#include <linux/slab.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_eh.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi_tcq.h>
 
 /* Core SCSI definitions */
 #define AIC_LIB_PREFIX ahc
-#include "scsi.h"
-#include <scsi/scsi_host.h>
 
 /* Name space conflict with BSD queue macros */
 #ifdef LIST_HEAD
@@ -106,7 +110,7 @@
 /************************* Forward Declarations *******************************/
 struct ahc_softc;
 typedef struct pci_dev *ahc_dev_softc_t;
-typedef Scsi_Cmnd      *ahc_io_ctx_t;
+typedef struct scsi_cmnd      *ahc_io_ctx_t;
 
 /******************************* Byte Order ***********************************/
 #define ahc_htobe16(x)  cpu_to_be16(x)
@@ -144,7 +148,7 @@ typedef Scsi_Cmnd      *ahc_io_ctx_t;
 extern u_int aic7xxx_no_probe;
 extern u_int aic7xxx_allow_memio;
 extern int aic7xxx_detect_complete;
-extern Scsi_Host_Template aic7xxx_driver_template;
+extern struct scsi_host_template aic7xxx_driver_template;
 
 /***************************** Bus Space/DMA **********************************/
 
@@ -174,11 +178,7 @@ struct ahc_linux_dma_tag
 };
 typedef struct ahc_linux_dma_tag* bus_dma_tag_t;
 
-struct ahc_linux_dmamap
-{
-        dma_addr_t      bus_addr;
-};
-typedef struct ahc_linux_dmamap* bus_dmamap_t;
+typedef dma_addr_t bus_dmamap_t;
 
 typedef int bus_dma_filter_t(void*, dma_addr_t);
 typedef void bus_dmamap_callback_t(void *, bus_dma_segment_t *, int, int);
@@ -281,12 +281,6 @@ ahc_scb_timer_reset(struct scb *scb, u_int usec)
 /***************************** SMP support ************************************/
 #include <linux/spinlock.h>
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0) || defined(SCSI_HAS_HOST_LOCK))
-#define AHC_SCSI_HAS_HOST_LOCK 1
-#else
-#define AHC_SCSI_HAS_HOST_LOCK 0
-#endif
-
 #define AIC7XXX_DRIVER_VERSION "6.2.36"
 
 /**************************** Front End Queues ********************************/
@@ -328,20 +322,15 @@ struct ahc_cmd {
  */
 TAILQ_HEAD(ahc_busyq, ahc_cmd);
 typedef enum {
-        AHC_DEV_UNCONFIGURED     = 0x01,
         AHC_DEV_FREEZE_TIL_EMPTY = 0x02, /* Freeze queue until active == 0 */
-        AHC_DEV_TIMER_ACTIVE     = 0x04, /* Our timer is active */
-        AHC_DEV_ON_RUN_LIST      = 0x08, /* Queued to be run later */
         AHC_DEV_Q_BASIC          = 0x10, /* Allow basic device queuing */
         AHC_DEV_Q_TAGGED         = 0x20, /* Allow full SCSI2 command queueing */
         AHC_DEV_PERIODIC_OTAG    = 0x40, /* Send OTAG to prevent starvation */
-        AHC_DEV_SLAVE_CONFIGURED = 0x80  /* slave_configure() has been called */
 } ahc_linux_dev_flags;
 
 struct ahc_linux_target;
 struct ahc_linux_device {
         TAILQ_ENTRY(ahc_linux_device) links;
-        struct          ahc_busyq busyq;
 
         /*
          * The number of transactions currently
@@ -382,11 +371,6 @@ struct ahc_linux_device {
         ahc_linux_dev_flags     flags;
 
         /*
-         * Per device timer.
-         */
-        struct timer_list       timer;
-
-        /*
          * The high limit for the tags variable.
          */
         u_int                   maxtags;
@@ -419,14 +403,10 @@ struct ahc_linux_device {
 #define AHC_OTAG_THRESH 500
 
         int                     lun;
-        Scsi_Device            *scsi_device;
+        struct scsi_device       *scsi_device;
         struct                  ahc_linux_target *target;
 };
 
-typedef enum {
-        AHC_INQ_VALID            = 0x02,
-} ahc_linux_targ_flags;
-
 struct ahc_linux_target {
         struct ahc_linux_device  *devices[AHC_NUM_LUNS];
         int                       channel;
@@ -434,8 +414,6 @@ struct ahc_linux_target {
         int                       refcount;
         struct ahc_transinfo      last_tinfo;
         struct ahc_softc         *ahc;
-        ahc_linux_targ_flags      flags;
-        struct scsi_inquiry_data *inq_data;
 };
 
 /********************* Definitions Required by the Core ***********************/
@@ -445,32 +423,16 @@ struct ahc_linux_target {
  * manner and are allocated below 4GB, the number of S/G segments is
  * unrestricted.
  */
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-/*
- * We dynamically adjust the number of segments in pre-2.5 kernels to
- * avoid fragmentation issues in the SCSI mid-layer's private memory
- * allocator.  See aic7xxx_osm.c ahc_linux_size_nseg() for details.
- */
-extern u_int ahc_linux_nseg;
-#define AHC_NSEG ahc_linux_nseg
-#define AHC_LINUX_MIN_NSEG 64
-#else
 #define AHC_NSEG 128
-#endif
 
 /*
  * Per-SCB OSM storage.
  */
-typedef enum {
-        AHC_UP_EH_SEMAPHORE = 0x1
-} ahc_linux_scb_flags;
-
 struct scb_platform_data {
         struct ahc_linux_device *dev;
         dma_addr_t               buf_busaddr;
         uint32_t                 xfer_len;
         uint32_t                 sense_resid;   /* Auto-Sense residual */
-        ahc_linux_scb_flags      flags;
 };
 
 /*
@@ -479,39 +441,24 @@ struct scb_platform_data {
  * alignment restrictions of the various platforms supported by
  * this driver.
  */
-typedef enum {
-        AHC_RUN_CMPLT_Q_TIMER    = 0x10
-} ahc_linux_softc_flags;
-
-TAILQ_HEAD(ahc_completeq, ahc_cmd);
-
 struct ahc_platform_data {
         /*
          * Fields accessed from interrupt context.
          */
         struct ahc_linux_target *targets[AHC_NUM_TARGETS]; 
-        TAILQ_HEAD(, ahc_linux_device) device_runq;
-        struct ahc_completeq     completeq;
 
         spinlock_t               spin_lock;
-        struct tasklet_struct    runq_tasklet;
         u_int                    qfrozen;
-        pid_t                    dv_pid;
-        struct timer_list        completeq_timer;
         struct timer_list        reset_timer;
         struct semaphore         eh_sem;
-        struct semaphore         dv_sem;
-        struct semaphore         dv_cmd_sem;    /* XXX This needs to be in
-                                                 * the target struct
-                                                 */
-        struct scsi_device      *dv_scsi_dev;
         struct Scsi_Host        *host;          /* pointer to scsi host */
 #define AHC_LINUX_NOIRQ ((uint32_t)~0)
         uint32_t                 irq;           /* IRQ for this adapter */
         uint32_t                 bios_address;
         uint32_t                 mem_busaddr;   /* Mem Base Addr */
-        uint64_t                 hw_dma_mask;
-        ahc_linux_softc_flags    flags;
+
+#define AHC_UP_EH_SEMAPHORE      0x1
+        uint32_t                 flags;
 };
 
 /************************** OS Utility Wrappers *******************************/
@@ -600,7 +547,7 @@ ahc_insb(struct ahc_softc * ahc, long port, uint8_t *array, int count)
 
 /**************************** Initialization **********************************/
 int             ahc_linux_register_host(struct ahc_softc *,
-                                        Scsi_Host_Template *);
+                                        struct scsi_host_template *);
 
 uint64_t        ahc_linux_get_memsize(void);
 
@@ -621,17 +568,6 @@ static __inline void ahc_lockinit(struct ahc_softc *);
 static __inline void ahc_lock(struct ahc_softc *, unsigned long *flags);
 static __inline void ahc_unlock(struct ahc_softc *, unsigned long *flags);
 
-/* Lock acquisition and release of the above lock in midlayer entry points. */
-static __inline void ahc_midlayer_entrypoint_lock(struct ahc_softc *,
-                                                  unsigned long *flags);
-static __inline void ahc_midlayer_entrypoint_unlock(struct ahc_softc *,
-                                                    unsigned long *flags);
-
-/* Lock held during command compeletion to the upper layer */
-static __inline void ahc_done_lockinit(struct ahc_softc *);
-static __inline void ahc_done_lock(struct ahc_softc *, unsigned long *flags);
-static __inline void ahc_done_unlock(struct ahc_softc *, unsigned long *flags);
-
 /* Lock held during ahc_list manipulation and ahc softc frees */
 extern spinlock_t ahc_list_spinlock;
 static __inline void ahc_list_lockinit(void);
@@ -657,57 +593,6 @@ ahc_unlock(struct ahc_softc *ahc, unsigned long *flags)
 }
 
 static __inline void
-ahc_midlayer_entrypoint_lock(struct ahc_softc *ahc, unsigned long *flags)
-{
-        /*
-         * In 2.5.X and some 2.4.X versions, the midlayer takes our
-         * lock just before calling us, so we avoid locking again.
-         * For other kernel versions, the io_request_lock is taken
-         * just before our entry point is called.  In this case, we
-         * trade the io_request_lock for our per-softc lock.
-         */
-#if AHC_SCSI_HAS_HOST_LOCK == 0
-        spin_unlock(&io_request_lock);
-        spin_lock(&ahc->platform_data->spin_lock);
-#endif
-}
-
-static __inline void
-ahc_midlayer_entrypoint_unlock(struct ahc_softc *ahc, unsigned long *flags)
-{
-#if AHC_SCSI_HAS_HOST_LOCK == 0
-        spin_unlock(&ahc->platform_data->spin_lock);
-        spin_lock(&io_request_lock);
-#endif
-}
-
-static __inline void
-ahc_done_lockinit(struct ahc_softc *ahc)
-{
-        /*
-         * In 2.5.X, our own lock is held during completions.
-         * In previous versions, the io_request_lock is used.
-         * In either case, we can't initialize this lock again.
-         */
-}
-
-static __inline void
-ahc_done_lock(struct ahc_softc *ahc, unsigned long *flags)
-{
-#if AHC_SCSI_HAS_HOST_LOCK == 0
-        spin_lock_irqsave(&io_request_lock, *flags);
-#endif
-}
-
-static __inline void
-ahc_done_unlock(struct ahc_softc *ahc, unsigned long *flags)
-{
-#if AHC_SCSI_HAS_HOST_LOCK == 0
-        spin_unlock_irqrestore(&io_request_lock, *flags);
-#endif
-}
-
-static __inline void
 ahc_list_lockinit(void)
 {
         spin_lock_init(&ahc_list_spinlock);
@@ -773,12 +658,6 @@ typedef enum
 } ahc_power_state;
 
 /**************************** VL/EISA Routines ********************************/
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0) \
-  && (defined(__i386__) || defined(__alpha__)) \
-  && (!defined(CONFIG_EISA)))
-#define CONFIG_EISA
-#endif
-
 #ifdef CONFIG_EISA
 extern uint32_t aic7xxx_probe_eisa_vl;
 int                      ahc_linux_eisa_init(void);
@@ -894,22 +773,18 @@ ahc_flush_device_writes(struct ahc_softc *ahc)
 }
 
 /**************************** Proc FS Support *********************************/
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-int     ahc_linux_proc_info(char *, char **, off_t, int, int, int);
-#else
 int     ahc_linux_proc_info(struct Scsi_Host *, char *, char **,
                             off_t, int, int);
-#endif
 
 /*************************** Domain Validation ********************************/
 /*********************** Transaction Access Wrappers *************************/
-static __inline void ahc_cmd_set_transaction_status(Scsi_Cmnd *, uint32_t);
+static __inline void ahc_cmd_set_transaction_status(struct scsi_cmnd *, uint32_t);
 static __inline void ahc_set_transaction_status(struct scb *, uint32_t);
-static __inline void ahc_cmd_set_scsi_status(Scsi_Cmnd *, uint32_t);
+static __inline void ahc_cmd_set_scsi_status(struct scsi_cmnd *, uint32_t);
 static __inline void ahc_set_scsi_status(struct scb *, uint32_t);
-static __inline uint32_t ahc_cmd_get_transaction_status(Scsi_Cmnd *cmd);
+static __inline uint32_t ahc_cmd_get_transaction_status(struct scsi_cmnd *cmd);
 static __inline uint32_t ahc_get_transaction_status(struct scb *);
-static __inline uint32_t ahc_cmd_get_scsi_status(Scsi_Cmnd *cmd);
+static __inline uint32_t ahc_cmd_get_scsi_status(struct scsi_cmnd *cmd);
 static __inline uint32_t ahc_get_scsi_status(struct scb *);
 static __inline void ahc_set_transaction_tag(struct scb *, int, u_int);
 static __inline u_long ahc_get_transfer_length(struct scb *);
@@ -928,7 +803,7 @@ static __inline void ahc_platform_scb_free(struct ahc_softc *ahc,
 static __inline void ahc_freeze_scb(struct scb *scb);
 
 static __inline
-void ahc_cmd_set_transaction_status(Scsi_Cmnd *cmd, uint32_t status)
+void ahc_cmd_set_transaction_status(struct scsi_cmnd *cmd, uint32_t status)
 {
         cmd->result &= ~(CAM_STATUS_MASK << 16);
         cmd->result |= status << 16;
@@ -941,7 +816,7 @@ void ahc_set_transaction_status(struct scb *scb, uint32_t status)
 }
 
 static __inline
-void ahc_cmd_set_scsi_status(Scsi_Cmnd *cmd, uint32_t status)
+void ahc_cmd_set_scsi_status(struct scsi_cmnd *cmd, uint32_t status)
 {
         cmd->result &= ~0xFFFF;
         cmd->result |= status;
@@ -954,7 +829,7 @@ void ahc_set_scsi_status(struct scb *scb, uint32_t status)
 }
 
 static __inline
-uint32_t ahc_cmd_get_transaction_status(Scsi_Cmnd *cmd)
+uint32_t ahc_cmd_get_transaction_status(struct scsi_cmnd *cmd)
 {
         return ((cmd->result >> 16) & CAM_STATUS_MASK);
 }
@@ -966,7 +841,7 @@ uint32_t ahc_get_transaction_status(struct scb *scb)
 }
 
 static __inline
-uint32_t ahc_cmd_get_scsi_status(Scsi_Cmnd *cmd)
+uint32_t ahc_cmd_get_scsi_status(struct scsi_cmnd *cmd)
 {
         return (cmd->result & 0xFFFF);
 }
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
index 6f6674aa31ef..2a0ebce83e7a 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
@@ -221,13 +221,11 @@ ahc_linux_pci_dev_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          && ahc_linux_get_memsize() > 0x80000000
          && pci_set_dma_mask(pdev, mask_39bit) == 0) {
                 ahc->flags |= AHC_39BIT_ADDRESSING;
-                ahc->platform_data->hw_dma_mask = mask_39bit;
         } else {
                 if (pci_set_dma_mask(pdev, DMA_32BIT_MASK)) {
                         printk(KERN_WARNING "aic7xxx: No suitable DMA available.\n");
                         return (-ENODEV);
                 }
-                ahc->platform_data->hw_dma_mask = DMA_32BIT_MASK;
         }
         ahc->dev_softc = pci;
         error = ahc_pci_config(ahc, entry);
@@ -236,15 +234,8 @@ ahc_linux_pci_dev_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return (-error);
         }
         pci_set_drvdata(pdev, ahc);
-        if (aic7xxx_detect_complete) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,0)
+        if (aic7xxx_detect_complete)
                 ahc_linux_register_host(ahc, &aic7xxx_driver_template);
-#else
-                printf("aic7xxx: ignoring PCI device found after "
-                       "initialization\n");
-                return (-ENODEV);
-#endif
-        }
         return (0);
 }
 
diff --git a/drivers/scsi/aic7xxx/aic7xxx_proc.c b/drivers/scsi/aic7xxx/aic7xxx_proc.c
index 85e80eecc9d0..5fece859fbd9 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_proc.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_proc.c
@@ -289,13 +289,8 @@ done:
  * Return information to handle /proc support for the driver.
  */
 int
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-ahc_linux_proc_info(char *buffer, char **start, off_t offset,
-                    int length, int hostno, int inout)
-#else
 ahc_linux_proc_info(struct Scsi_Host *shost, char *buffer, char **start,
                     off_t offset, int length, int inout)
-#endif
 {
         struct  ahc_softc *ahc;
         struct  info_str info;
@@ -307,15 +302,7 @@ ahc_linux_proc_info(struct Scsi_Host *shost, char *buffer, char **start,
 
         retval = -EINVAL;
         ahc_list_lock(&s);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-        TAILQ_FOREACH(ahc, &ahc_tailq, links) {
-                if (ahc->platform_data->host->host_no == hostno)
-                        break;
-        }
-#else
         ahc = ahc_find_softc(*(struct ahc_softc **)shost->hostdata);
-#endif
-
         if (ahc == NULL)
                 goto done;
 
diff --git a/drivers/scsi/aic7xxx/aiclib.c b/drivers/scsi/aic7xxx/aiclib.c
index 79bfd9efd8ed..7c5a6db0e672 100644
--- a/drivers/scsi/aic7xxx/aiclib.c
+++ b/drivers/scsi/aic7xxx/aiclib.c
@@ -35,7 +35,6 @@
 #include <linux/version.h>
 
 /* Core SCSI definitions */
-#include "scsi.h"
 #include <scsi/scsi_host.h>
 #include "aiclib.h"
 #include "cam.h"
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 0b5d3a5b7eda..ee9b96da841e 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -1253,11 +1253,11 @@ void __sata_phy_reset(struct ata_port *ap)
         unsigned long timeout = jiffies + (HZ * 5);
 
         if (ap->flags & ATA_FLAG_SATA_RESET) {
-                scr_write(ap, SCR_CONTROL, 0x301); /* issue phy wake/reset */
-                scr_read(ap, SCR_STATUS);       /* dummy read; flush */
+                /* issue phy wake/reset */
+                scr_write_flush(ap, SCR_CONTROL, 0x301);
                 udelay(400);                    /* FIXME: a guess */
         }
-        scr_write(ap, SCR_CONTROL, 0x300);      /* issue phy wake/clear reset */
+        scr_write_flush(ap, SCR_CONTROL, 0x300); /* phy wake/clear reset */
 
         /* wait for phy to become ready, if necessary */
         do {
@@ -2539,7 +2539,7 @@ static void atapi_request_sense(struct ata_port *ap, struct ata_device *dev,
         ata_sg_init_one(qc, cmd->sense_buffer, sizeof(cmd->sense_buffer));
         qc->dma_dir = DMA_FROM_DEVICE;
 
-        memset(&qc->cdb, 0, sizeof(ap->cdb_len));
+        memset(&qc->cdb, 0, ap->cdb_len);
         qc->cdb[0] = REQUEST_SENSE;
         qc->cdb[4] = SCSI_SENSE_BUFFERSIZE;
 
@@ -2811,6 +2811,7 @@ void ata_qc_complete(struct ata_queued_cmd *qc, u8 drv_stat)
 
         /* call completion callback */
         rc = qc->complete_fn(qc, drv_stat);
+        qc->flags &= ~ATA_QCFLAG_ACTIVE;
 
         /* if callback indicates not to complete command (non-zero),
          * return immediately
@@ -3229,7 +3230,8 @@ irqreturn_t ata_interrupt (int irq, void *dev_instance, struct pt_regs *regs)
                         struct ata_queued_cmd *qc;
 
                         qc = ata_qc_from_tag(ap, ap->active_tag);
-                        if (qc && (!(qc->tf.ctl & ATA_NIEN)))
+                        if (qc && (!(qc->tf.ctl & ATA_NIEN)) &&
+                            (qc->flags & ATA_QCFLAG_ACTIVE))
                                 handled |= ata_host_intr(ap, qc);
                 }
         }
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 4c96df060c3b..416ba67ba9ee 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -347,7 +347,10 @@ int ata_scsi_slave_config(struct scsi_device *sdev)
                  */
                 if ((dev->flags & ATA_DFLAG_LBA48) &&
                     ((dev->flags & ATA_DFLAG_LOCK_SECTORS) == 0)) {
-                        sdev->host->max_sectors = 2048;
+                        /*
+                         * do not overwrite sdev->host->max_sectors, since
+                         * other drives on this host may not support LBA48
+                         */
                         blk_queue_max_sectors(sdev->request_queue, 2048);
                 }
         }
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 2240a0cde583..9bc1f153f7ea 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -300,7 +300,7 @@ qla2x00_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout)
         rport->dev_loss_tmo = ha->port_down_retry_count + 5;
 }
 
-static struct fc_function_template qla2xxx_transport_functions = {
+struct fc_function_template qla2xxx_transport_functions = {
 
         .show_host_node_name = 1,
         .show_host_port_name = 1,
@@ -322,12 +322,6 @@ static struct fc_function_template qla2xxx_transport_functions = {
 
 };
 
-struct scsi_transport_template *
-qla2x00_alloc_transport_tmpl(void)
-{
-        return (fc_attach_transport(&qla2xxx_transport_functions));
-}
-
 void
 qla2x00_init_host_attr(scsi_qla_host_t *ha)
 {
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index e4bfe4d5bbe4..2efec6c24d60 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -24,7 +24,6 @@
 #define __QLA_GBL_H
 
 #include <linux/interrupt.h>
-#include <scsi/scsi_transport.h>
 
 extern void qla2x00_remove_one(struct pci_dev *);
 extern int qla2x00_probe_one(struct pci_dev *, struct qla_board_info *);
@@ -248,9 +247,10 @@ extern void qla2x00_cancel_io_descriptors(scsi_qla_host_t *);
 /*
  * Global Function Prototypes in qla_attr.c source file.
  */
+struct fc_function_template;
+extern struct fc_function_template qla2xxx_transport_functions;
 extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *);
 extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *);
-extern struct scsi_transport_template *qla2x00_alloc_transport_tmpl(void);
 extern void qla2x00_init_host_attr(scsi_qla_host_t *);
 extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *);
 extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 84db911318c6..579448222d69 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2350,7 +2350,8 @@ qla2x00_module_init(void)
 #if DEBUG_QLA2100
         strcat(qla2x00_version_str, "-debug");
 #endif
-        qla2xxx_transport_template = qla2x00_alloc_transport_tmpl();
+        qla2xxx_transport_template =
+            fc_attach_transport(&qla2xxx_transport_functions);
         if (!qla2xxx_transport_template)
                 return -ENODEV;
 
diff --git a/drivers/scsi/sata_svw.c b/drivers/scsi/sata_svw.c
index 8d1a5d25c053..05075bd3a893 100644
--- a/drivers/scsi/sata_svw.c
+++ b/drivers/scsi/sata_svw.c
@@ -395,7 +395,7 @@ static int k2_sata_init_one (struct pci_dev *pdev, const struct pci_device_id *e
 
         /* Clear a magic bit in SCR1 according to Darwin, those help
          * some funky seagate drives (though so far, those were already
-         * set by the firmware on the machines I had access to
+         * set by the firmware on the machines I had access to)
          */
         writel(readl(mmio_base + K2_SATA_SICR1_OFFSET) & ~0x00040000,
                mmio_base + K2_SATA_SICR1_OFFSET);
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 05d2bd075fd4..184bcaeaf812 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -542,7 +542,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
                  * that the device is no longer present */
                 cmd->result = DID_NO_CONNECT << 16;
                 atomic_inc(&cmd->device->iorequest_cnt);
-                scsi_done(cmd);
+                __scsi_done(cmd);
                 /* return 0 (because the command has been processed) */
                 goto out;
         }
diff --git a/drivers/scsi/scsi_transport_spi.c b/drivers/scsi/scsi_transport_spi.c
index 303d7656f710..67c6cc40ce16 100644
--- a/drivers/scsi/scsi_transport_spi.c
+++ b/drivers/scsi/scsi_transport_spi.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/workqueue.h>
+#include <linux/blkdev.h>
 #include <asm/semaphore.h>
 #include <scsi/scsi.h>
 #include "scsi_priv.h"
@@ -34,13 +35,18 @@
 
 #define SPI_PRINTK(x, l, f, a...)       dev_printk(l, &(x)->dev, f , ##a)
 
-#define SPI_NUM_ATTRS 10        /* increase this if you add attributes */
+#define SPI_NUM_ATTRS 13        /* increase this if you add attributes */
 #define SPI_OTHER_ATTRS 1       /* Increase this if you add "always
                                  * on" attributes */
 #define SPI_HOST_ATTRS  1
 
 #define SPI_MAX_ECHO_BUFFER_SIZE        4096
 
+#define DV_LOOPS        3
+#define DV_TIMEOUT      (10*HZ)
+#define DV_RETRIES      3       /* should only need at most 
+                                 * two cc/ua clears */
+
 /* Private data accessors (keep these out of the header file) */
 #define spi_dv_pending(x) (((struct spi_transport_attrs *)&(x)->starget_data)->dv_pending)
 #define spi_dv_sem(x) (((struct spi_transport_attrs *)&(x)->starget_data)->dv_sem)
@@ -100,6 +106,29 @@ static int sprint_frac(char *dest, int value, int denom)
         return result;
 }
 
+/* Modification of scsi_wait_req that will clear UNIT ATTENTION conditions
+ * resulting from (likely) bus and device resets */
+static void spi_wait_req(struct scsi_request *sreq, const void *cmd,
+                         void *buffer, unsigned bufflen)
+{
+        int i;
+
+        for(i = 0; i < DV_RETRIES; i++) {
+                sreq->sr_request->flags |= REQ_FAILFAST;
+
+                scsi_wait_req(sreq, cmd, buffer, bufflen,
+                              DV_TIMEOUT, /* retries */ 1);
+                if (sreq->sr_result & DRIVER_SENSE) {
+                        struct scsi_sense_hdr sshdr;
+
+                        if (scsi_request_normalize_sense(sreq, &sshdr)
+                            && sshdr.sense_key == UNIT_ATTENTION)
+                                continue;
+                }
+                break;
+        }
+}
+
 static struct {
         enum spi_signal_type    value;
         char                    *name;
@@ -190,8 +219,11 @@ static int spi_setup_transport_attrs(struct device *dev)
         struct scsi_target *starget = to_scsi_target(dev);
 
         spi_period(starget) = -1;       /* illegal value */
+        spi_min_period(starget) = 0;
         spi_offset(starget) = 0;        /* async */
+        spi_max_offset(starget) = 255;
         spi_width(starget) = 0; /* narrow */
+        spi_max_width(starget) = 1;
         spi_iu(starget) = 0;    /* no IU */
         spi_dt(starget) = 0;    /* ST */
         spi_qas(starget) = 0;
@@ -206,6 +238,34 @@ static int spi_setup_transport_attrs(struct device *dev)
         return 0;
 }
 
+#define spi_transport_show_simple(field, format_string)                 \
+                                                                        \
+static ssize_t                                                          \
+show_spi_transport_##field(struct class_device *cdev, char *buf)        \
+{                                                                       \
+        struct scsi_target *starget = transport_class_to_starget(cdev); \
+        struct spi_transport_attrs *tp;                                 \
+                                                                        \
+        tp = (struct spi_transport_attrs *)&starget->starget_data;      \
+        return snprintf(buf, 20, format_string, tp->field);             \
+}
+
+#define spi_transport_store_simple(field, format_string)                \
+                                                                        \
+static ssize_t                                                          \
+store_spi_transport_##field(struct class_device *cdev, const char *buf, \
+                            size_t count)                               \
+{                                                                       \
+        int val;                                                        \
+        struct scsi_target *starget = transport_class_to_starget(cdev); \
+        struct spi_transport_attrs *tp;                                 \
+                                                                        \
+        tp = (struct spi_transport_attrs *)&starget->starget_data;      \
+        val = simple_strtoul(buf, NULL, 0);                             \
+        tp->field = val;                                                \
+        return count;                                                   \
+}
+
 #define spi_transport_show_function(field, format_string)               \
                                                                         \
 static ssize_t                                                          \
@@ -232,6 +292,25 @@ store_spi_transport_##field(struct class_device *cdev, const char *buf, \
         struct spi_internal *i = to_spi_internal(shost->transportt);    \
                                                                         \
         val = simple_strtoul(buf, NULL, 0);                             \
+        i->f->set_##field(starget, val);                        \
+        return count;                                                   \
+}
+
+#define spi_transport_store_max(field, format_string)                   \
+static ssize_t                                                          \
+store_spi_transport_##field(struct class_device *cdev, const char *buf, \
+                            size_t count)                               \
+{                                                                       \
+        int val;                                                        \
+        struct scsi_target *starget = transport_class_to_starget(cdev); \
+        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);    \
+        struct spi_internal *i = to_spi_internal(shost->transportt);    \
+        struct spi_transport_attrs *tp                                  \
+                = (struct spi_transport_attrs *)&starget->starget_data; \
+                                                                        \
+        val = simple_strtoul(buf, NULL, 0);                             \
+        if (val > tp->max_##field)                                      \
+                val = tp->max_##field;                                  \
         i->f->set_##field(starget, val);                                \
         return count;                                                   \
 }
@@ -243,9 +322,24 @@ static CLASS_DEVICE_ATTR(field, S_IRUGO | S_IWUSR,			\
                          show_spi_transport_##field,                    \
                          store_spi_transport_##field);
 
+#define spi_transport_simple_attr(field, format_string)                 \
+        spi_transport_show_simple(field, format_string)                 \
+        spi_transport_store_simple(field, format_string)                \
+static CLASS_DEVICE_ATTR(field, S_IRUGO | S_IWUSR,                      \
+                         show_spi_transport_##field,                    \
+                         store_spi_transport_##field);
+
+#define spi_transport_max_attr(field, format_string)                    \
+        spi_transport_show_function(field, format_string)               \
+        spi_transport_store_max(field, format_string)                   \
+        spi_transport_simple_attr(max_##field, format_string)           \
+static CLASS_DEVICE_ATTR(field, S_IRUGO | S_IWUSR,                      \
+                         show_spi_transport_##field,                    \
+                         store_spi_transport_##field);
+
 /* The Parallel SCSI Tranport Attributes: */
-spi_transport_rd_attr(offset, "%d\n");
-spi_transport_rd_attr(width, "%d\n");
+spi_transport_max_attr(offset, "%d\n");
+spi_transport_max_attr(width, "%d\n");
 spi_transport_rd_attr(iu, "%d\n");
 spi_transport_rd_attr(dt, "%d\n");
 spi_transport_rd_attr(qas, "%d\n");
@@ -271,26 +365,18 @@ static CLASS_DEVICE_ATTR(revalidate, S_IWUSR, NULL, store_spi_revalidate);
 
 /* Translate the period into ns according to the current spec
  * for SDTR/PPR messages */
-static ssize_t show_spi_transport_period(struct class_device *cdev, char *buf)
-
+static ssize_t
+show_spi_transport_period_helper(struct class_device *cdev, char *buf,
+                                 int period)
 {
-        struct scsi_target *starget = transport_class_to_starget(cdev);
-        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
-        struct spi_transport_attrs *tp;
         int len, picosec;
-        struct spi_internal *i = to_spi_internal(shost->transportt);
-
-        tp = (struct spi_transport_attrs *)&starget->starget_data;
 
-        if (i->f->get_period)
-                i->f->get_period(starget);
-
-        if (tp->period < 0 || tp->period > 0xff) {
+        if (period < 0 || period > 0xff) {
                 picosec = -1;
-        } else if (tp->period <= SPI_STATIC_PPR) {
-                picosec = ppr_to_ps[tp->period];
+        } else if (period <= SPI_STATIC_PPR) {
+                picosec = ppr_to_ps[period];
         } else {
-                picosec = tp->period * 4000;
+                picosec = period * 4000;
         }
 
         if (picosec == -1) {
@@ -305,12 +391,9 @@ static ssize_t show_spi_transport_period(struct class_device *cdev, char *buf)
 }
 
 static ssize_t
-store_spi_transport_period(struct class_device *cdev, const char *buf,
-                            size_t count)
+store_spi_transport_period_helper(struct class_device *cdev, const char *buf,
+                                  size_t count, int *periodp)
 {
-        struct scsi_target *starget = transport_class_to_starget(cdev);
-        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
-        struct spi_internal *i = to_spi_internal(shost->transportt);
         int j, picosec, period = -1;
         char *endp;
 
@@ -339,15 +422,79 @@ store_spi_transport_period(struct class_device *cdev, const char *buf,
         if (period > 0xff)
                 period = 0xff;
 
-        i->f->set_period(starget, period);
+        *periodp = period;
 
         return count;
 }
 
+static ssize_t
+show_spi_transport_period(struct class_device *cdev, char *buf)
+{
+        struct scsi_target *starget = transport_class_to_starget(cdev);
+        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        struct spi_internal *i = to_spi_internal(shost->transportt);
+        struct spi_transport_attrs *tp =
+                (struct spi_transport_attrs *)&starget->starget_data;
+
+        if (i->f->get_period)
+                i->f->get_period(starget);
+
+        return show_spi_transport_period_helper(cdev, buf, tp->period);
+}
+
+static ssize_t
+store_spi_transport_period(struct class_device *cdev, const char *buf,
+                            size_t count)
+{
+        struct scsi_target *starget = transport_class_to_starget(cdev);
+        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+        struct spi_internal *i = to_spi_internal(shost->transportt);
+        struct spi_transport_attrs *tp =
+                (struct spi_transport_attrs *)&starget->starget_data;
+        int period, retval;
+
+        retval = store_spi_transport_period_helper(cdev, buf, count, &period);
+
+        if (period < tp->min_period)
+                period = tp->min_period;
+
+        i->f->set_period(starget, period);
+
+        return retval;
+}
+
 static CLASS_DEVICE_ATTR(period, S_IRUGO | S_IWUSR, 
                          show_spi_transport_period,
                          store_spi_transport_period);
 
+static ssize_t
+show_spi_transport_min_period(struct class_device *cdev, char *buf)
+{
+        struct scsi_target *starget = transport_class_to_starget(cdev);
+        struct spi_transport_attrs *tp =
+                (struct spi_transport_attrs *)&starget->starget_data;
+
+        return show_spi_transport_period_helper(cdev, buf, tp->min_period);
+}
+
+static ssize_t
+store_spi_transport_min_period(struct class_device *cdev, const char *buf,
+                            size_t count)
+{
+        struct scsi_target *starget = transport_class_to_starget(cdev);
+        struct spi_transport_attrs *tp =
+                (struct spi_transport_attrs *)&starget->starget_data;
+
+        return store_spi_transport_period_helper(cdev, buf, count,
+                                                 &tp->min_period);
+}
+
+
+static CLASS_DEVICE_ATTR(min_period, S_IRUGO | S_IWUSR, 
+                         show_spi_transport_min_period,
+                         store_spi_transport_min_period);
+
+
 static ssize_t show_spi_host_signalling(struct class_device *cdev, char *buf)
 {
         struct Scsi_Host *shost = transport_class_to_shost(cdev);
@@ -378,11 +525,6 @@ static CLASS_DEVICE_ATTR(signalling, S_IRUGO | S_IWUSR,
         if(i->f->set_##x)               \
                 i->f->set_##x(sdev->sdev_target, y)
 
-#define DV_LOOPS        3
-#define DV_TIMEOUT      (10*HZ)
-#define DV_RETRIES      3       /* should only need at most 
-                                 * two cc/ua clears */
-
 enum spi_compare_returns {
         SPI_COMPARE_SUCCESS,
         SPI_COMPARE_FAILURE,
@@ -446,8 +588,7 @@ spi_dv_device_echo_buffer(struct scsi_request *sreq, u8 *buffer,
         for (r = 0; r < retries; r++) {
                 sreq->sr_cmd_len = 0;   /* wait_req to fill in */
                 sreq->sr_data_direction = DMA_TO_DEVICE;
-                scsi_wait_req(sreq, spi_write_buffer, buffer, len,
-                              DV_TIMEOUT, DV_RETRIES);
+                spi_wait_req(sreq, spi_write_buffer, buffer, len);
                 if(sreq->sr_result || !scsi_device_online(sdev)) {
                         struct scsi_sense_hdr sshdr;
 
@@ -471,8 +612,7 @@ spi_dv_device_echo_buffer(struct scsi_request *sreq, u8 *buffer,
                 memset(ptr, 0, len);
                 sreq->sr_cmd_len = 0;   /* wait_req to fill in */
                 sreq->sr_data_direction = DMA_FROM_DEVICE;
-                scsi_wait_req(sreq, spi_read_buffer, ptr, len,
-                              DV_TIMEOUT, DV_RETRIES);
+                spi_wait_req(sreq, spi_read_buffer, ptr, len);
                 scsi_device_set_state(sdev, SDEV_QUIESCE);
 
                 if (memcmp(buffer, ptr, len) != 0)
@@ -500,8 +640,7 @@ spi_dv_device_compare_inquiry(struct scsi_request *sreq, u8 *buffer,
 
                 memset(ptr, 0, len);
 
-                scsi_wait_req(sreq, spi_inquiry, ptr, len,
-                              DV_TIMEOUT, DV_RETRIES);
+                spi_wait_req(sreq, spi_inquiry, ptr, len);
                 
                 if(sreq->sr_result || !scsi_device_online(sdev)) {
                         scsi_device_set_state(sdev, SDEV_QUIESCE);
@@ -593,8 +732,7 @@ spi_dv_device_get_echo_buffer(struct scsi_request *sreq, u8 *buffer)
          * (reservation conflict, device not ready, etc) just
          * skip the write tests */
         for (l = 0; ; l++) {
-                scsi_wait_req(sreq, spi_test_unit_ready, NULL, 0,
-                              DV_TIMEOUT, DV_RETRIES);
+                spi_wait_req(sreq, spi_test_unit_ready, NULL, 0);
 
                 if(sreq->sr_result) {
                         if(l >= 3)
@@ -608,8 +746,7 @@ spi_dv_device_get_echo_buffer(struct scsi_request *sreq, u8 *buffer)
         sreq->sr_cmd_len = 0;
         sreq->sr_data_direction = DMA_FROM_DEVICE;
 
-        scsi_wait_req(sreq, spi_read_buffer_descriptor, buffer, 4,
-                      DV_TIMEOUT, DV_RETRIES);
+        spi_wait_req(sreq, spi_read_buffer_descriptor, buffer, 4);
 
         if (sreq->sr_result)
                 /* Device has no echo buffer */
@@ -623,6 +760,7 @@ spi_dv_device_internal(struct scsi_request *sreq, u8 *buffer)
 {
         struct spi_internal *i = to_spi_internal(sreq->sr_host->transportt);
         struct scsi_device *sdev = sreq->sr_device;
+        struct scsi_target *starget = sdev->sdev_target;
         int len = sdev->inquiry_len;
         /* first set us up for narrow async */
         DV_SET(offset, 0);
@@ -636,9 +774,11 @@ spi_dv_device_internal(struct scsi_request *sreq, u8 *buffer)
         }
 
         /* test width */
-        if (i->f->set_width && sdev->wdtr) {
+        if (i->f->set_width && spi_max_width(starget) && sdev->wdtr) {
                 i->f->set_width(sdev->sdev_target, 1);
 
+                printk("WIDTH IS %d\n", spi_max_width(starget));
+
                 if (spi_dv_device_compare_inquiry(sreq, buffer,
                                                    buffer + len,
                                                    DV_LOOPS)
@@ -665,8 +805,8 @@ spi_dv_device_internal(struct scsi_request *sreq, u8 *buffer)
  retry:
 
         /* now set up to the maximum */
-        DV_SET(offset, 255);
-        DV_SET(period, 1);
+        DV_SET(offset, spi_max_offset(starget));
+        DV_SET(period, spi_min_period(starget));
 
         if (len == 0) {
                 SPI_PRINTK(sdev->sdev_target, KERN_INFO, "Domain Validation skipping write tests\n");
@@ -873,6 +1013,16 @@ EXPORT_SYMBOL(spi_display_xfer_agreement);
         if (i->f->show_##field)                                         \
                 count++
 
+#define SETUP_RELATED_ATTRIBUTE(field, rel_field)                       \
+        i->private_attrs[count] = class_device_attr_##field;            \
+        if (!i->f->set_##rel_field) {                                   \
+                i->private_attrs[count].attr.mode = S_IRUGO;            \
+                i->private_attrs[count].store = NULL;                   \
+        }                                                               \
+        i->attrs[count] = &i->private_attrs[count];                     \
+        if (i->f->show_##rel_field)                                     \
+                count++
+
 #define SETUP_HOST_ATTRIBUTE(field)                                     \
         i->private_host_attrs[count] = class_device_attr_##field;       \
         if (!i->f->set_##field) {                                       \
@@ -956,8 +1106,11 @@ spi_attach_transport(struct spi_function_template *ft)
         i->f = ft;
 
         SETUP_ATTRIBUTE(period);
+        SETUP_RELATED_ATTRIBUTE(min_period, period);
         SETUP_ATTRIBUTE(offset);
+        SETUP_RELATED_ATTRIBUTE(max_offset, offset);
         SETUP_ATTRIBUTE(width);
+        SETUP_RELATED_ATTRIBUTE(max_width, width);
         SETUP_ATTRIBUTE(iu);
         SETUP_ATTRIBUTE(dt);
         SETUP_ATTRIBUTE(qas);
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index 3471be05779a..82d68fdb1548 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -281,6 +281,9 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn)
         char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd));
         int result;
 
+        if (!buffer)
+                return -ENOMEM;
+
         memset(&cgc, 0, sizeof(struct packet_command));
         cgc.cmd[0] = GPCMD_READ_SUBCHANNEL;
         cgc.cmd[2] = 0x40;      /* I do want the subchannel info */
diff --git a/drivers/scsi/sym53c416.c b/drivers/scsi/sym53c416.c
index f26c3a29e631..ebfddd40ce67 100644
--- a/drivers/scsi/sym53c416.c
+++ b/drivers/scsi/sym53c416.c
@@ -809,7 +809,7 @@ static int sym53c416_host_reset(Scsi_Cmnd *SCpnt)
         /* printk("sym53c416_reset\n"); */
         base = SCpnt->device->host->io_port;
         /* search scsi_id - fixme, we shouldnt need to iterate for this! */
-        for(i = 0; i < host_index && scsi_id != -1; i++)
+        for(i = 0; i < host_index && scsi_id == -1; i++)
                 if(hosts[i].base == base)
                         scsi_id = hosts[i].scsi_id;
         outb(RESET_CHIP, base + COMMAND_REG);
diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
index 5ff83d214f12..5b07c6ec3ecc 100644
--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
+++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
@@ -2038,8 +2038,9 @@ static void sym2_set_period(struct scsi_target *starget, int period)
         struct sym_hcb *np = sym_get_hcb(shost);
         struct sym_tcb *tp = &np->target[starget->id];
 
-        /* have to have DT for these transfers */
-        if (period <= np->minsync)
+        /* have to have DT for these transfers, but DT will also
+         * set width, so check that this is allowed */
+        if (period <= np->minsync && spi_width(starget))
                 tp->tgoal.dt = 1;
 
         tp->tgoal.period = period;
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index 33fbda79f350..0b10169961eb 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -126,18 +126,8 @@ static irqreturn_t serial21285_rx_chars(int irq, void *dev_id, struct pt_regs *r
                                 flag = TTY_FRAME;
                 }
 
-                if ((rxs & port->ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-                if ((rxs & RXSTAT_OVERRUN) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+                uart_insert_char(port, rxs, RXSTAT_OVERRUN, ch, flag);
+
                 status = *CSR_UARTFLG;
         }
         tty_flip_buffer_push(tty);
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 0d9358608fdf..3bbf0cc6e53f 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -1122,18 +1122,9 @@ receive_chars(struct uart_8250_port *up, int *status, struct pt_regs *regs)
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto ignore_char;
-                if ((lsr & up->port.ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-                if ((lsr & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+
+                uart_insert_char(&up->port, lsr, UART_LSR_OE, ch, flag);
+
         ignore_char:
                 lsr = serial_inp(up, UART_LSR);
         } while ((lsr & UART_LSR_DR) && (max_count-- > 0));
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index f8d90d0ecfea..de54bdc5398b 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -1009,6 +1009,8 @@ get_pci_irq(struct pci_dev *dev, struct pci_board *board, int idx)
  *  n    = number of serial ports
  *  baud = baud rate
  *
+ * This table is sorted by (in order): baud, bt, bn, n.
+ *
  * Please note: in theory if n = 1, _bt infix should make no difference.
  * ie, pbn_b0_1_115200 is the same as pbn_b0_bt_1_115200
  */
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index f2a5e2933c47..2884b310e54d 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -198,18 +198,8 @@ pl010_rx_chars(struct uart_port *port)
                 if (uart_handle_sysrq_char(port, ch, regs))
                         goto ignore_char;
 
-                if ((rsr & port->ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-                if ((rsr & UART01x_RSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+                uart_insert_char(port, rsr, UART01x_RSR_OE, ch, flag);
+
         ignore_char:
                 status = UART_GET_FR(port);
         }
diff --git a/drivers/serial/amba-pl011.c b/drivers/serial/amba-pl011.c
index d5cbef3fe8b6..7db88ee18f75 100644
--- a/drivers/serial/amba-pl011.c
+++ b/drivers/serial/amba-pl011.c
@@ -163,18 +163,8 @@ pl011_rx_chars(struct uart_amba_port *uap)
                 if (uart_handle_sysrq_char(&uap->port, ch, regs))
                         goto ignore_char;
 
-                if ((rsr & uap->port.ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-                if ((rsr & UART01x_RSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+                uart_insert_char(&uap->port, rsr, UART01x_RSR_OE, ch, flag);
+
         ignore_char:
                 status = readw(uap->port.membase + UART01x_FR);
         }
diff --git a/drivers/serial/clps711x.c b/drivers/serial/clps711x.c
index 6242f3090a96..e92522b33c48 100644
--- a/drivers/serial/clps711x.c
+++ b/drivers/serial/clps711x.c
@@ -143,10 +143,7 @@ static irqreturn_t clps711xuart_int_rx(int irq, void *dev_id, struct pt_regs *re
                  * CHECK: does overrun affect the current character?
                  * ASSUMPTION: it does not.
                  */
-                if ((ch & port->ignore_status_mask & ~RXSTAT_OVERRUN) == 0)
-                        tty_insert_flip_char(tty, ch, flg);
-                if ((ch & ~port->ignore_status_mask & RXSTAT_OVERRUN) == 0)
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                uart_insert_char(port, ch, UARTDR_OVERR, ch, flg);
 
         ignore_char:
                 status = clps_readl(SYSFLG(port));
diff --git a/drivers/serial/pxa.c b/drivers/serial/pxa.c
index 51d8a49f4477..9dc151d8fa61 100644
--- a/drivers/serial/pxa.c
+++ b/drivers/serial/pxa.c
@@ -161,20 +161,12 @@ receive_chars(struct uart_pxa_port *up, int *status, struct pt_regs *regs)
                         else if (*status & UART_LSR_FE)
                                 flag = TTY_FRAME;
                 }
+
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto ignore_char;
-                if ((*status & up->port.ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-                if ((*status & UART_LSR_OE) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+
+                uart_insert_char(&up->port, *status, UART_LSR_OE, ch, flag);
+
         ignore_char:
                 *status = serial_in(up, UART_LSR);
         } while ((*status & UART_LSR_DR) && (max_count-- > 0));
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index 435750d40a47..2a9f7ade2c9d 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -394,20 +394,7 @@ s3c24xx_serial_rx_chars(int irq, void *dev_id, struct pt_regs *regs)
                 if (uart_handle_sysrq_char(port, ch, regs))
                         goto ignore_char;
 
-                if ((uerstat & port->ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-
-                if ((uerstat & S3C2410_UERSTAT_OVERRUN) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+                uart_insert_char(port, uerstat, S3C2410_UERSTAT_OVERRUN, ch, flag);
 
         ignore_char:
                 continue;
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index 157218bc6c6f..22565a67a57c 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -237,10 +237,7 @@ sa1100_rx_chars(struct sa1100_port *sport, struct pt_regs *regs)
                 if (uart_handle_sysrq_char(&sport->port, ch, regs))
                         goto ignore_char;
 
-                if ((status & port->ignore_status_mask & ~UTSR1_TO_SM(UTSR1_ROR)) == 0)
-                        tty_insert_flip_char(tty, ch, flg);
-                if (status & ~port->ignore_status_mask & UTSR1_TO_SM(UTSR1_ROR))
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+                uart_insert_char(&sport->port, status, UTSR1_TO_SM(UTSR1_ROR), ch, flg);
 
         ignore_char:
                 status = UTSR1_TO_SM(UART_GET_UTSR1(sport)) |
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 6eeb48f6a482..0d7b65f93e8d 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -661,10 +661,10 @@ void serial_config(dev_link_t * link)
         /* Is this a multiport card? */
         tuple->DesiredTuple = CISTPL_MANFID;
         if (first_tuple(handle, tuple, parse) == CS_SUCCESS) {
-                info->manfid = le16_to_cpu(buf[0]);
+                info->manfid = parse->manfid.manf;
                 for (i = 0; i < MULTI_COUNT; i++)
                         if ((info->manfid == multi_id[i].manfid) &&
-                            (le16_to_cpu(buf[1]) == multi_id[i].prodid))
+                            (parse->manfid.card == multi_id[i].prodid))
                                 break;
                 if (i < MULTI_COUNT)
                         info->multi = multi_id[i].multi;
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index 85cfa08d3bad..56f269b6bfb1 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -190,18 +190,7 @@ lh7a40xuart_rx_chars (struct uart_port* port)
                 if (uart_handle_sysrq_char (port, (unsigned char) data, regs))
                         continue;
 
-                if ((data & port->ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, data, flag);
-                }
-                if ((data & RxOverrunError)
-                    && tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+                uart_insert_char(port, data, RxOverrunError, data, flag);
         }
         tty_flip_buffer_push (tty);
         return;
diff --git a/drivers/serial/serial_txx9.c b/drivers/serial/serial_txx9.c
index 37b2ef297cbe..3f1051a4a13f 100644
--- a/drivers/serial/serial_txx9.c
+++ b/drivers/serial/serial_txx9.c
@@ -350,18 +350,9 @@ receive_chars(struct uart_txx9_port *up, unsigned int *status, struct pt_regs *r
                 }
                 if (uart_handle_sysrq_char(&up->port, ch, regs))
                         goto ignore_char;
-                if ((disr & up->port.ignore_status_mask) == 0) {
-                        tty_insert_flip_char(tty, ch, flag);
-                }
-                if ((disr & TXX9_SIDISR_UOER) &&
-                    tty->flip.count < TTY_FLIPBUF_SIZE) {
-                        /*
-                         * Overrun is special, since it's reported
-                         * immediately, and doesn't affect the current
-                         * character.
-                         */
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
-                }
+
+                uart_insert_char(&up->port, disr, TXX9_SIDISR_UOER, ch, flag);
+
         ignore_char:
                 disr = sio_in(up, TXX9_SIDISR);
         } while (!(disr & TXX9_SIDISR_UVALID) && (max_count-- > 0));
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 39b788d95e39..10e2990a40d4 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -61,6 +61,16 @@ struct uart_sunsab_port {
         unsigned char                   pvr_dtr_bit;    /* Which PVR bit is DTR */
         unsigned char                   pvr_dsr_bit;    /* Which PVR bit is DSR */
         int                             type;           /* SAB82532 version     */
+
+        /* Setting configuration bits while the transmitter is active
+         * can cause garbage characters to get emitted by the chip.
+         * Therefore, we cache such writes here and do the real register
+         * write the next time the transmitter becomes idle.
+         */
+        unsigned int                    cached_ebrg;
+        unsigned char                   cached_mode;
+        unsigned char                   cached_pvr;
+        unsigned char                   cached_dafo;
 };
 
 /*
@@ -236,6 +246,7 @@ receive_chars(struct uart_sunsab_port *up,
 }
 
 static void sunsab_stop_tx(struct uart_port *, unsigned int);
+static void sunsab_tx_idle(struct uart_sunsab_port *);
 
 static void transmit_chars(struct uart_sunsab_port *up,
                            union sab82532_irq_status *stat)
@@ -258,6 +269,7 @@ static void transmit_chars(struct uart_sunsab_port *up,
                 return;
 
         set_bit(SAB82532_XPR, &up->irqflags);
+        sunsab_tx_idle(up);
 
         if (uart_circ_empty(xmit) || uart_tx_stopped(&up->port)) {
                 up->interrupt_mask1 |= SAB82532_IMR1_XPR;
@@ -397,21 +409,21 @@ static void sunsab_set_mctrl(struct uart_port *port, unsigned int mctrl)
         struct uart_sunsab_port *up = (struct uart_sunsab_port *) port;
 
         if (mctrl & TIOCM_RTS) {
-                writeb(readb(&up->regs->rw.mode) & ~SAB82532_MODE_FRTS,
-                       &up->regs->rw.mode);
-                writeb(readb(&up->regs->rw.mode) | SAB82532_MODE_RTS,
-                       &up->regs->rw.mode);
+                up->cached_mode &= ~SAB82532_MODE_FRTS;
+                up->cached_mode |= SAB82532_MODE_RTS;
         } else {
-                writeb(readb(&up->regs->rw.mode) | SAB82532_MODE_FRTS,
-                       &up->regs->rw.mode);
-                writeb(readb(&up->regs->rw.mode) | SAB82532_MODE_RTS,
-                       &up->regs->rw.mode);
+                up->cached_mode |= (SAB82532_MODE_FRTS |
+                                    SAB82532_MODE_RTS);
         }
         if (mctrl & TIOCM_DTR) {
-                writeb(readb(&up->regs->rw.pvr) & ~(up->pvr_dtr_bit), &up->regs->rw.pvr);
+                up->cached_pvr &= ~(up->pvr_dtr_bit);
         } else {
-                writeb(readb(&up->regs->rw.pvr) | up->pvr_dtr_bit, &up->regs->rw.pvr);
+                up->cached_pvr |= up->pvr_dtr_bit;
         }
+
+        set_bit(SAB82532_REGS_PENDING, &up->irqflags);
+        if (test_bit(SAB82532_XPR, &up->irqflags))
+                sunsab_tx_idle(up);
 }
 
 /* port->lock is not held.  */
@@ -450,6 +462,25 @@ static void sunsab_stop_tx(struct uart_port *port, unsigned int tty_stop)
 }
 
 /* port->lock held by caller.  */
+static void sunsab_tx_idle(struct uart_sunsab_port *up)
+{
+        if (test_bit(SAB82532_REGS_PENDING, &up->irqflags)) {
+                u8 tmp;
+
+                clear_bit(SAB82532_REGS_PENDING, &up->irqflags);
+                writeb(up->cached_mode, &up->regs->rw.mode);
+                writeb(up->cached_pvr, &up->regs->rw.pvr);
+                writeb(up->cached_dafo, &up->regs->w.dafo);
+
+                writeb(up->cached_ebrg & 0xff, &up->regs->w.bgr);
+                tmp = readb(&up->regs->rw.ccr2);
+                tmp &= ~0xc0;
+                tmp |= (up->cached_ebrg >> 2) & 0xc0;
+                writeb(tmp, &up->regs->rw.ccr2);
+        }
+}
+
+/* port->lock held by caller.  */
 static void sunsab_start_tx(struct uart_port *port, unsigned int tty_start)
 {
         struct uart_sunsab_port *up = (struct uart_sunsab_port *) port;
@@ -517,12 +548,16 @@ static void sunsab_break_ctl(struct uart_port *port, int break_state)
 
         spin_lock_irqsave(&up->port.lock, flags);
 
-        val = readb(&up->regs->rw.dafo);
+        val = up->cached_dafo;
         if (break_state)
                 val |= SAB82532_DAFO_XBRK;
         else
                 val &= ~SAB82532_DAFO_XBRK;
-        writeb(val, &up->regs->rw.dafo);
+        up->cached_dafo = val;
+
+        set_bit(SAB82532_REGS_PENDING, &up->irqflags);
+        if (test_bit(SAB82532_XPR, &up->irqflags))
+                sunsab_tx_idle(up);
 
         spin_unlock_irqrestore(&up->port.lock, flags);
 }
@@ -566,8 +601,9 @@ static int sunsab_startup(struct uart_port *port)
                SAB82532_CCR2_TOE, &up->regs->w.ccr2);
         writeb(0, &up->regs->w.ccr3);
         writeb(SAB82532_CCR4_MCK4 | SAB82532_CCR4_EBRG, &up->regs->w.ccr4);
-        writeb(SAB82532_MODE_RTS | SAB82532_MODE_FCTS |
-               SAB82532_MODE_RAC, &up->regs->w.mode);
+        up->cached_mode = (SAB82532_MODE_RTS | SAB82532_MODE_FCTS |
+                           SAB82532_MODE_RAC);
+        writeb(up->cached_mode, &up->regs->w.mode);
         writeb(SAB82532_RFC_DPS|SAB82532_RFC_RFTH_32, &up->regs->w.rfc);
         
         tmp = readb(&up->regs->rw.ccr0);
@@ -598,7 +634,6 @@ static void sunsab_shutdown(struct uart_port *port)
 {
         struct uart_sunsab_port *up = (struct uart_sunsab_port *) port;
         unsigned long flags;
-        unsigned char tmp;
 
         spin_lock_irqsave(&up->port.lock, flags);
 
@@ -609,14 +644,13 @@ static void sunsab_shutdown(struct uart_port *port)
         writeb(up->interrupt_mask1, &up->regs->w.imr1);
 
         /* Disable break condition */
-        tmp = readb(&up->regs->rw.dafo);
-        tmp &= ~SAB82532_DAFO_XBRK;
-        writeb(tmp, &up->regs->rw.dafo);
+        up->cached_dafo = readb(&up->regs->rw.dafo);
+        up->cached_dafo &= ~SAB82532_DAFO_XBRK;
+        writeb(up->cached_dafo, &up->regs->rw.dafo);
 
         /* Disable Receiver */  
-        tmp = readb(&up->regs->rw.mode);
-        tmp &= ~SAB82532_MODE_RAC;
-        writeb(tmp, &up->regs->rw.mode);
+        up->cached_mode &= ~SAB82532_MODE_RAC;
+        writeb(up->cached_mode, &up->regs->rw.mode);
 
         /*
          * XXX FIXME
@@ -685,7 +719,6 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
                                   unsigned int iflag, unsigned int baud,
                                   unsigned int quot)
 {
-        unsigned int ebrg;
         unsigned char dafo;
         int bits, n, m;
 
@@ -714,10 +747,11 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
         } else {
                 dafo |= SAB82532_DAFO_PAR_EVEN;
         }
+        up->cached_dafo = dafo;
 
         calc_ebrg(baud, &n, &m);
 
-        ebrg = n | (m << 6);
+        up->cached_ebrg = n | (m << 6);
 
         up->tec_timeout = (10 * 1000000) / baud;
         up->cec_timeout = up->tec_timeout >> 2;
@@ -770,16 +804,13 @@ static void sunsab_convert_to_sab(struct uart_sunsab_port *up, unsigned int cfla
         uart_update_timeout(&up->port, cflag,
                             (up->port.uartclk / (16 * quot)));
 
-        /* Now bang the new settings into the chip.  */
-        sunsab_cec_wait(up);
-        sunsab_tec_wait(up);
-        writeb(dafo, &up->regs->w.dafo);
-        writeb(ebrg & 0xff, &up->regs->w.bgr);
-        writeb((readb(&up->regs->rw.ccr2) & ~0xc0) | ((ebrg >> 2) & 0xc0),
-               &up->regs->rw.ccr2);
-
-        writeb(readb(&up->regs->rw.mode) | SAB82532_MODE_RAC, &up->regs->rw.mode);
-
+        /* Now schedule a register update when the chip's
+         * transmitter is idle.
+         */
+        up->cached_mode |= SAB82532_MODE_RAC;
+        set_bit(SAB82532_REGS_PENDING, &up->irqflags);
+        if (test_bit(SAB82532_XPR, &up->irqflags))
+                sunsab_tx_idle(up);
 }
 
 /* port->lock is not held.  */
@@ -1084,11 +1115,13 @@ static void __init sunsab_init_hw(void)
                         up->pvr_dsr_bit = (1 << 3);
                         up->pvr_dtr_bit = (1 << 2);
                 }
-                writeb((1 << 1) | (1 << 2) | (1 << 4), &up->regs->w.pvr);
-                writeb(readb(&up->regs->rw.mode) | SAB82532_MODE_FRTS,
-                       &up->regs->rw.mode);
-                writeb(readb(&up->regs->rw.mode) | SAB82532_MODE_RTS,
-                       &up->regs->rw.mode);
+                up->cached_pvr = (1 << 1) | (1 << 2) | (1 << 4);
+                writeb(up->cached_pvr, &up->regs->w.pvr);
+                up->cached_mode = readb(&up->regs->rw.mode);
+                up->cached_mode |= SAB82532_MODE_FRTS;
+                writeb(up->cached_mode, &up->regs->rw.mode);
+                up->cached_mode |= SAB82532_MODE_RTS;
+                writeb(up->cached_mode, &up->regs->rw.mode);
 
                 up->tec_timeout = SAB82532_MAX_TEC_TIMEOUT;
                 up->cec_timeout = SAB82532_MAX_CEC_TIMEOUT;
diff --git a/drivers/serial/sunsab.h b/drivers/serial/sunsab.h
index 686086fcbbf5..b78e1f7b8050 100644
--- a/drivers/serial/sunsab.h
+++ b/drivers/serial/sunsab.h
@@ -126,6 +126,7 @@ union sab82532_irq_status {
 /* irqflags bits */
 #define SAB82532_ALLS                   0x00000001
 #define SAB82532_XPR                    0x00000002
+#define SAB82532_REGS_PENDING           0x00000004
 
 /* RFIFO Status Byte */
 #define SAB82532_RSTAT_PE               0x80
diff --git a/drivers/serial/vr41xx_siu.c b/drivers/serial/vr41xx_siu.c
index 307886199f2f..5d2ceb623e6f 100644
--- a/drivers/serial/vr41xx_siu.c
+++ b/drivers/serial/vr41xx_siu.c
@@ -412,10 +412,8 @@ static inline void receive_chars(struct uart_port *port, uint8_t *status,
 
                 if (uart_handle_sysrq_char(port, ch, regs))
                         goto ignore_char;
-                if ((lsr & port->ignore_status_mask) == 0)
-                        tty_insert_flip_char(tty, ch, flag);
-                if ((lsr & UART_LSR_OE) && (tty->flip.count < TTY_FLIPBUF_SIZE))
-                        tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+
+                uart_insert_char(port, lsr, UART_LSR_OE, ch, flag);
 
         ignore_char:
                 lsr = siu_read(port, UART_LSR);
diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
index 5538756f13ba..d5863b8b56ee 100644
--- a/drivers/telephony/ixj.c
+++ b/drivers/telephony/ixj.c
@@ -41,9 +41,6 @@
  *
  ***************************************************************************/
 
-static char ixj_c_rcsid[] = "$Id: ixj.c,v 4.7 2001/08/13 06:19:33 craigs Exp $";
-static char ixj_c_revision[] = "$Revision: 4.7 $";
-
 /*
  * $Log: ixj.c,v $
  *
@@ -6172,8 +6169,14 @@ static int ixj_ioctl(struct inode *inode, struct file *file_p, unsigned int cmd,
                 retval = j->serial;
                 break;
         case IXJCTL_VERSION:
-                if (copy_to_user(argp, ixj_c_revision, strlen(ixj_c_revision))) 
-                        retval = -EFAULT;
+                {
+                        char arg_str[100];
+                        snprintf(arg_str, sizeof(arg_str),
+                                "\nDriver version %i.%i.%i", IXJ_VER_MAJOR,
+                                IXJ_VER_MINOR, IXJ_BLD_VER);
+                        if (copy_to_user(argp, arg_str, strlen(arg_str)))
+                                retval = -EFAULT;
+                }
                 break;
         case PHONE_RING_CADENCE:
                 j->ring_cadence = arg;
@@ -7168,9 +7171,6 @@ static int ixj_get_status_proc(char *buf)
         int cnt;
         IXJ *j;
         len = 0;
-        len += sprintf(buf + len, "%s", ixj_c_rcsid);
-        len += sprintf(buf + len, "\n%s", ixj_h_rcsid);
-        len += sprintf(buf + len, "\n%s", ixjuser_h_rcsid);
         len += sprintf(buf + len, "\nDriver version %i.%i.%i", IXJ_VER_MAJOR, IXJ_VER_MINOR, IXJ_BLD_VER);
         len += sprintf(buf + len, "\nsizeof IXJ struct %Zd bytes", sizeof(IXJ));
         len += sprintf(buf + len, "\nsizeof DAA struct %Zd bytes", sizeof(DAA_REGS));
@@ -7790,7 +7790,7 @@ static int __init ixj_init(void)
         if ((probe = ixj_probe_pci(&cnt)) < 0) {
                 return probe;
         }
-        printk("%s\n", ixj_c_rcsid);
+        printk(KERN_INFO "ixj driver initialized.\n");
         create_proc_read_entry ("ixj", 0, NULL, ixj_read_proc, NULL);
         return probe;
 }
diff --git a/drivers/telephony/ixj.h b/drivers/telephony/ixj.h
index 143818a56121..51e3f7f6597b 100644
--- a/drivers/telephony/ixj.h
+++ b/drivers/telephony/ixj.h
@@ -38,8 +38,6 @@
  * TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
  *
  *****************************************************************************/
-static char ixj_h_rcsid[] = "$Id: ixj.h,v 4.1 2001/08/04 14:49:27 craigs Exp $";
-
 #define IXJ_VERSION 3031
 
 #include <linux/version.h>
diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
index ec9b3bde8ae5..4ab50009291d 100644
--- a/drivers/usb/core/sysfs.c
+++ b/drivers/usb/core/sysfs.c
@@ -286,6 +286,39 @@ static ssize_t show_interface_string(struct device *dev, char *buf)
 }
 static DEVICE_ATTR(interface, S_IRUGO, show_interface_string, NULL);
 
+static ssize_t show_modalias(struct device *dev, char *buf)
+{
+        struct usb_interface *intf;
+        struct usb_device *udev;
+
+        intf = to_usb_interface(dev);
+        udev = interface_to_usbdev(intf);
+        if (udev->descriptor.bDeviceClass == 0) {
+                struct usb_host_interface *alt = intf->cur_altsetting;
+
+                return sprintf(buf, "usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic%02Xisc%02Xip%02X\n",
+                               le16_to_cpu(udev->descriptor.idVendor),
+                               le16_to_cpu(udev->descriptor.idProduct),
+                               le16_to_cpu(udev->descriptor.bcdDevice),
+                               udev->descriptor.bDeviceClass,
+                               udev->descriptor.bDeviceSubClass,
+                               udev->descriptor.bDeviceProtocol,
+                               alt->desc.bInterfaceClass,
+                               alt->desc.bInterfaceSubClass,
+                               alt->desc.bInterfaceProtocol);
+        } else {
+                return sprintf(buf, "usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic*isc*ip*\n",
+                               le16_to_cpu(udev->descriptor.idVendor),
+                               le16_to_cpu(udev->descriptor.idProduct),
+                               le16_to_cpu(udev->descriptor.bcdDevice),
+                               udev->descriptor.bDeviceClass,
+                               udev->descriptor.bDeviceSubClass,
+                               udev->descriptor.bDeviceProtocol);
+        }
+
+}
+static DEVICE_ATTR(modalias, S_IRUGO, show_modalias, NULL);
+
 static struct attribute *intf_attrs[] = {
         &dev_attr_bInterfaceNumber.attr,
         &dev_attr_bAlternateSetting.attr,
@@ -293,6 +326,7 @@ static struct attribute *intf_attrs[] = {
         &dev_attr_bInterfaceClass.attr,
         &dev_attr_bInterfaceSubClass.attr,
         &dev_attr_bInterfaceProtocol.attr,
+        &dev_attr_modalias.attr,
         NULL,
 };
 static struct attribute_group intf_attr_grp = {
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 02fefab3501e..429330bc38de 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -72,6 +72,7 @@ static int ehci_hub_suspend (struct usb_hcd *hcd)
         }
 
         /* turn off now-idle HC */
+        del_timer_sync (&ehci->watchdog);
         ehci_halt (ehci);
         hcd->state = HC_STATE_SUSPENDED;
 
diff --git a/drivers/usb/net/Kconfig b/drivers/usb/net/Kconfig
index db64c908d4a7..b104430e2c6a 100644
--- a/drivers/usb/net/Kconfig
+++ b/drivers/usb/net/Kconfig
@@ -219,17 +219,21 @@ config USB_EPSON2888
           by some sample firmware from Epson.
 
 config USB_ZAURUS
-        boolean "Sharp Zaurus (stock ROMs)"
+        boolean "Sharp Zaurus (stock ROMs) and compatible"
         depends on USB_USBNET
         select CRC32
         default y
         help
           Choose this option to support the usb networking links used by
           Zaurus models like the SL-5000D, SL-5500, SL-5600, A-300, B-500.
-
-          If you install an alternate ROM image, you may no longer need
-          to support this protocol.  Only the "eth-fd" driver really needs
-          this non-conformant variant of CDC Ethernet protocol.
+          This also supports some related device firmware, as used in some
+          PDAs from Olympus and some cell phones from Motorola.
+
+          If you install an alternate ROM image, such as the Linux 2.6 based
+          versions of OpenZaurus, you should no longer need to support this
+          protocol.  Only the "eth-fd" or "net_fd" drivers in these devices
+          really need this non-conformant variant of CDC Ethernet (or in
+          some cases CDC MDLM) protocol, not "g_ether".
 
 config USB_CDCETHER
         boolean "CDC Ethernet support (smart devices such as cable modems)"
diff --git a/drivers/usb/net/usbnet.c b/drivers/usb/net/usbnet.c
index f6bc6b3b333c..85476e76b244 100644
--- a/drivers/usb/net/usbnet.c
+++ b/drivers/usb/net/usbnet.c
@@ -1517,6 +1517,26 @@ static void cdc_unbind (struct usbnet *dev, struct usb_interface *intf)
         }
 }
 
+#endif  /* NEED_GENERIC_CDC */
+
+
+#ifdef  CONFIG_USB_CDCETHER
+#define HAVE_HARDWARE
+
+/*-------------------------------------------------------------------------
+ *
+ * Communications Device Class, Ethernet Control model
+ *
+ * Takes two interfaces.  The DATA interface is inactive till an altsetting
+ * is selected.  Configuration data includes class descriptors.
+ *
+ * This should interop with whatever the 2.4 "CDCEther.c" driver
+ * (by Brad Hards) talked with.
+ *
+ *-------------------------------------------------------------------------*/
+
+#include <linux/ctype.h>
+
 
 static void dumpspeed (struct usbnet *dev, __le32 *speeds)
 {
@@ -1567,26 +1587,6 @@ static void cdc_status (struct usbnet *dev, struct urb *urb)
         }
 }
 
-#endif  /* NEED_GENERIC_CDC */
-
-
-#ifdef  CONFIG_USB_CDCETHER
-#define HAVE_HARDWARE
-
-/*-------------------------------------------------------------------------
- *
- * Communications Device Class, Ethernet Control model
- * 
- * Takes two interfaces.  The DATA interface is inactive till an altsetting
- * is selected.  Configuration data includes class descriptors.
- *
- * This should interop with whatever the 2.4 "CDCEther.c" driver
- * (by Brad Hards) talked with.
- *
- *-------------------------------------------------------------------------*/
-
-#include <linux/ctype.h>
-
 static u8 nibble (unsigned char c)
 {
         if (likely (isdigit (c)))
@@ -2765,7 +2765,7 @@ static int blan_mdlm_bind (struct usbnet *dev, struct usb_interface *intf)
                         }
                         /* expect bcdVersion 1.0, ignore */
                         if (memcmp(&desc->bGUID, blan_guid, 16)
-                                    || memcmp(&desc->bGUID, blan_guid, 16) ) {
+                                    && memcmp(&desc->bGUID, blan_guid, 16) ) {
                                 /* hey, this one might _really_ be MDLM! */
                                 dev_dbg (&intf->dev, "MDLM guid\n");
                                 goto bad_desc;
@@ -2797,11 +2797,13 @@ static int blan_mdlm_bind (struct usbnet *dev, struct usb_interface *intf)
                          *  - bPad (ignored, for PADAFTER -- BLAN-only)
                          * bits are:
                          *  - 0x01 -- Zaurus framing (add CRC)
-                         *  - 0x02 -- PADBEFORE
-                         *  - 0x04 -- PADAFTER
+                         *  - 0x02 -- PADBEFORE (CRC includes some padding)
+                         *  - 0x04 -- PADAFTER (some padding after CRC)
                          *  - 0x08 -- "fermat" packet mangling (for hw bugs)
+                         * the PADBEFORE appears not to matter; we interop
+                         * with devices that use it and those that don't.
                          */
-                        if (detail->bDetailData[1] != 0x01) {
+                        if ((detail->bDetailData[1] & ~02) != 0x01) {
                                 /* bmDataCapabilites == 0 would be fine too,
                                  * but framing is minidriver-coupled for now.
                                  */
@@ -4071,9 +4073,6 @@ static const struct usb_device_id	products [] = {
         USB_DEVICE (0x8086, 0x07d3),    // "blob" bootloader
         .driver_info =  (unsigned long) &blob_info,
 }, {
-        USB_DEVICE (0x22b8, 0x600c),    // USBNET Motorola E680
-        .driver_info =  (unsigned long) &linuxdev_info,
-}, {
         // Linux Ethernet/RNDIS gadget on pxa210/25x/26x
         // e.g. Gumstix, current OpenZaurus, ...
         USB_DEVICE_VER (0x0525, 0xa4a2, 0x0203, 0x0203),
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index f34a9bb6a219..012e63e05806 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -89,6 +89,7 @@ static int interval;
 
 static struct usb_device_id id_table_earthmate [] = {
         { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
+        { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
         { }                                             /* Terminating entry */
 };
 
@@ -99,6 +100,7 @@ static struct usb_device_id id_table_cyphidcomrs232 [] = {
 
 static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
+        { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
         { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
         { }                                             /* Terminating entry */
 };
diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
index 1012ee6b19ce..1fa119efe41a 100644
--- a/drivers/usb/serial/cypress_m8.h
+++ b/drivers/usb/serial/cypress_m8.h
@@ -13,6 +13,7 @@
 /* DeLorme Earthmate USB - a GPS device */
 #define VENDOR_ID_DELORME                0x1163
 #define PRODUCT_ID_EARTHMATEUSB          0x0100
+#define PRODUCT_ID_EARTHMATEUSB_LT20     0x0200
 
 /* Cypress HID->COM RS232 Adapter */
 #define VENDOR_ID_CYPRESS                0x04b4
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 208a68ceb63b..7705070191d9 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1312,7 +1312,7 @@ int fb_get_options(char *name, char **option)
  *      Returns zero.
  *
  */
-int __init video_setup(char *options)
+static int __init video_setup(char *options)
 {
         int i, global = 0;
 
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index 2bdda4010b81..c78a2c5961d3 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -354,7 +354,7 @@ static ssize_t show_pan(struct class_device *class_device, char *buf)
                         fb_info->var.xoffset);
 }
 
-struct class_device_attribute class_device_attrs[] = {
+static struct class_device_attribute class_device_attrs[] = {
         __ATTR(bits_per_pixel, S_IRUGO|S_IWUSR, show_bpp, store_bpp),
         __ATTR(blank, S_IRUGO|S_IWUSR, show_blank, store_blank),
         __ATTR(color_map, S_IRUGO|S_IWUSR, show_cmap, store_cmap),
diff --git a/drivers/video/sis/init.c b/drivers/video/sis/init.c
index 1994054d45ff..ecfd72178dbb 100644
--- a/drivers/video/sis/init.c
+++ b/drivers/video/sis/init.c
@@ -1384,7 +1384,7 @@ SiSInitPCIetc(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
 /*             HELPER: SetLVDSetc            */
 /*********************************************/
 
-void
+static void
 SiSSetLVDSetc(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
 {
    USHORT temp;
@@ -1625,7 +1625,7 @@ SiS_ResetSegmentRegisters(SiS_Private *SiS_Pr,PSIS_HW_INFO HwInfo)
 /*             HELPER: GetVBType             */
 /*********************************************/
 
-void
+static void
 SiS_GetVBType(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
 {
   USHORT flag=0, rev=0, nolcd=0, p4_0f, p4_25, p4_27;
diff --git a/drivers/video/sis/init.h b/drivers/video/sis/init.h
index 35030d300431..7e36b7ac1470 100644
--- a/drivers/video/sis/init.h
+++ b/drivers/video/sis/init.h
@@ -2394,11 +2394,9 @@ void	SiS_SetRegOR(SISIOADDRESS Port,USHORT Index, USHORT DataOR);
 void    SiS_DisplayOn(SiS_Private *SiS_Pr);
 void    SiS_DisplayOff(SiS_Private *SiS_Pr);
 void    SiSRegInit(SiS_Private *SiS_Pr, SISIOADDRESS BaseAddr);
-void    SiSSetLVDSetc(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 BOOLEAN SiSDetermineROMLayout661(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 void    SiS_SetEnableDstn(SiS_Private *SiS_Pr, int enable);
 void    SiS_SetEnableFstn(SiS_Private *SiS_Pr, int enable);
-void    SiS_GetVBType(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 BOOLEAN SiS_SearchModeID(SiS_Private *SiS_Pr, USHORT *ModeNo, USHORT *ModeIdIndex);
 UCHAR   SiS_GetModePtr(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT ModeIdIndex);
 USHORT  SiS_GetColorDepth(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT ModeIdIndex);
@@ -2444,7 +2442,6 @@ extern void     SiS_GetLCDResInfo(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT Mod
 extern void     SiS_SetYPbPr(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 extern void     SiS_SetTVMode(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT ModeIdIndex, PSIS_HW_INFO HwInfo);
 extern void     SiS_UnLockCRT2(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
-extern void     SiS_LockCRT2(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 extern void     SiS_DisableBridge(SiS_Private *, PSIS_HW_INFO);
 extern BOOLEAN  SiS_SetCRT2Group(SiS_Private *, PSIS_HW_INFO, USHORT);
 extern USHORT   SiS_GetRatePtr(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT ModeIdIndex,
diff --git a/drivers/video/sis/init301.c b/drivers/video/sis/init301.c
index 2bc5b8097910..274dacd54bb8 100644
--- a/drivers/video/sis/init301.c
+++ b/drivers/video/sis/init301.c
@@ -86,6 +86,7 @@
 #define SiS_I2CDELAYSHORT  150
 
 static USHORT SiS_GetBIOSLCDResInfo(SiS_Private *SiS_Pr);
+static void SiS_SetCH70xx(SiS_Private *SiS_Pr, USHORT tempbx);
 
 /*********************************************/
 /*         HELPER: Lock/Unlock CRT2          */
@@ -100,7 +101,7 @@ SiS_UnLockCRT2(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
       SiS_SetRegOR(SiS_Pr->SiS_Part1Port,0x24,0x01);
 }
 
-void
+static void
 SiS_LockCRT2(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
 {
    if(HwInfo->jChipType >= SIS_315H)
@@ -4236,7 +4237,7 @@ SiS_DisableBridge(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
  * from outside the context of a mode switch!
  * MUST call getVBType before calling this
  */
-void
+static void
 SiS_EnableBridge(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo)
 {
   USHORT temp=0,tempah;
@@ -9219,7 +9220,7 @@ SiS_SetCH701x(SiS_Private *SiS_Pr, USHORT tempbx)
   SiS_SetChReg(SiS_Pr, tempbx, 0);
 }
 
-void
+static void
 SiS_SetCH70xx(SiS_Private *SiS_Pr, USHORT tempbx)
 {
   if(SiS_Pr->SiS_IF_DEF_CH70xx == 1)
@@ -9323,7 +9324,7 @@ SiS_GetCH701x(SiS_Private *SiS_Pr, USHORT tempbx)
 
 /* Read from Chrontel 70xx */
 /* Parameter is [Register no (S7-S0)] */
-USHORT
+static USHORT
 SiS_GetCH70xx(SiS_Private *SiS_Pr, USHORT tempbx)
 {
   if(SiS_Pr->SiS_IF_DEF_CH70xx == 1)
diff --git a/drivers/video/sis/init301.h b/drivers/video/sis/init301.h
index f05aebc994b4..f84eb54164a5 100644
--- a/drivers/video/sis/init301.h
+++ b/drivers/video/sis/init301.h
@@ -293,7 +293,6 @@ static UCHAR SiS300_TrumpionData[7][80] = {
 #endif
 
 void    SiS_UnLockCRT2(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
-void    SiS_LockCRT2(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 void    SiS_EnableCRT2(SiS_Private *SiS_Pr);
 USHORT  SiS_GetRatePtr(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT ModeIdIndex, PSIS_HW_INFO HwInfo);
 void    SiS_WaitRetrace1(SiS_Private *SiS_Pr);
@@ -310,7 +309,6 @@ USHORT	SiS_GetVCLK2Ptr(SiS_Private *SiS_Pr, USHORT ModeNo, USHORT ModeIdIndex,
                 USHORT RefreshRateTableIndex, PSIS_HW_INFO HwInfo);
 USHORT  SiS_GetResInfo(SiS_Private *SiS_Pr,USHORT ModeNo,USHORT ModeIdIndex);
 void    SiS_DisableBridge(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
-void    SiS_EnableBridge(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 BOOLEAN SiS_SetCRT2Group(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo, USHORT ModeNo);
 void    SiS_SiS30xBLOn(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
 void    SiS_SiS30xBLOff(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
@@ -319,8 +317,6 @@ void   	SiS_SetCH700x(SiS_Private *SiS_Pr, USHORT tempax);
 USHORT  SiS_GetCH700x(SiS_Private *SiS_Pr, USHORT tempax);
 void    SiS_SetCH701x(SiS_Private *SiS_Pr, USHORT tempax);
 USHORT  SiS_GetCH701x(SiS_Private *SiS_Pr, USHORT tempax);
-void    SiS_SetCH70xx(SiS_Private *SiS_Pr, USHORT tempax);
-USHORT  SiS_GetCH70xx(SiS_Private *SiS_Pr, USHORT tempax);
 void    SiS_SetCH70xxANDOR(SiS_Private *SiS_Pr, USHORT tempax,USHORT tempbh);
 #ifdef SIS315H
 static void     SiS_Chrontel701xOn(SiS_Private *SiS_Pr, PSIS_HW_INFO HwInfo);
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index b773c98f6513..698266036819 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -4762,7 +4762,8 @@ static void __devinit sisfb_post_sis315330(struct pci_dev *pdev)
 #endif
 
 
-int __devinit sisfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+static int __devinit sisfb_probe(struct pci_dev *pdev,
+                                 const struct pci_device_id *ent)
 {
         struct sisfb_chip_info  *chipinfo = &sisfb_chip_info[ent->driver_data];
         struct sis_video_info   *ivideo = NULL;
@@ -5940,7 +5941,7 @@ MODULE_PARM_DESC(videoram,
 #endif
 #endif
 
-int __devinit sisfb_init_module(void)
+static int __devinit sisfb_init_module(void)
 {
         sisfb_setdefaultparms();
 
diff --git a/fs/bad_inode.c b/fs/bad_inode.c
index 672a31924f3c..e172180a1d8c 100644
--- a/fs/bad_inode.c
+++ b/fs/bad_inode.c
@@ -47,7 +47,7 @@ static struct file_operations bad_file_ops =
         .get_unmapped_area = EIO_ERROR,
 };
 
-struct inode_operations bad_inode_ops =
+static struct inode_operations bad_inode_ops =
 {
         .create         = EIO_ERROR,
         .lookup         = EIO_ERROR,
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index ce9423bb2de3..c374be51b041 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -251,7 +251,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
         }
 
         /* Populate argv and envp */
-        p = current->mm->arg_start;
+        p = current->mm->arg_end = current->mm->arg_start;
         while (argc-- > 0) {
                 size_t len;
                 __put_user((elf_addr_t)p, argv++);
@@ -1301,7 +1301,7 @@ static void fill_prstatus(struct elf_prstatus *prstatus,
 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
                        struct mm_struct *mm)
 {
-        int i, len;
+        unsigned int i, len;
         
         /* first copy the parameters from user space */
         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
diff --git a/fs/block_dev.c b/fs/block_dev.c
index d19d07c49ad3..c0cbd1bc1a02 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -530,7 +530,7 @@ int check_disk_change(struct block_device *bdev)
         if (!bdops->media_changed(bdev->bd_disk))
                 return 0;
 
-        if (__invalidate_device(bdev, 0))
+        if (__invalidate_device(bdev))
                 printk("VFS: busy inodes on changed media.\n");
 
         if (bdops->revalidate_disk)
diff --git a/fs/buffer.c b/fs/buffer.c
index 5f525b3c6d9f..7e9e409feaa7 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1210,7 +1210,7 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
         return 1;
 }
 
-struct buffer_head *
+static struct buffer_head *
 __getblk_slow(struct block_device *bdev, sector_t block, int size)
 {
         /* Size must be multiple of hard sectorsize */
@@ -1809,7 +1809,6 @@ static int __block_write_full_page(struct inode *inode, struct page *page,
         } while (bh != head);
 
         do {
-                get_bh(bh);
                 if (!buffer_mapped(bh))
                         continue;
                 /*
@@ -1838,7 +1837,6 @@ static int __block_write_full_page(struct inode *inode, struct page *page,
          */
         BUG_ON(PageWriteback(page));
         set_page_writeback(page);
-        unlock_page(page);
 
         do {
                 struct buffer_head *next = bh->b_this_page;
@@ -1846,9 +1844,9 @@ static int __block_write_full_page(struct inode *inode, struct page *page,
                         submit_bh(WRITE, bh);
                         nr_underway++;
                 }
-                put_bh(bh);
                 bh = next;
         } while (bh != head);
+        unlock_page(page);
 
         err = 0;
 done:
@@ -1887,7 +1885,6 @@ recover:
         bh = head;
         /* Recovery: lock and submit the mapped buffers */
         do {
-                get_bh(bh);
                 if (buffer_mapped(bh) && buffer_dirty(bh)) {
                         lock_buffer(bh);
                         mark_buffer_async_write(bh);
@@ -1910,7 +1907,6 @@ recover:
                         submit_bh(WRITE, bh);
                         nr_underway++;
                 }
-                put_bh(bh);
                 bh = next;
         } while (bh != head);
         goto done;
@@ -1953,7 +1949,7 @@ static int __block_prepare_write(struct inode *inode, struct page *page,
                 if (!buffer_mapped(bh)) {
                         err = get_block(inode, block, bh, 1);
                         if (err)
-                                goto out;
+                                break;
                         if (buffer_new(bh)) {
                                 clear_buffer_new(bh);
                                 unmap_underlying_metadata(bh->b_bdev,
@@ -1995,10 +1991,12 @@ static int __block_prepare_write(struct inode *inode, struct page *page,
         while(wait_bh > wait) {
                 wait_on_buffer(*--wait_bh);
                 if (!buffer_uptodate(*wait_bh))
-                        return -EIO;
+                        err = -EIO;
         }
-        return 0;
-out:
+        if (!err)
+                return err;
+
+        /* Error case: */
         /*
          * Zero out any newly allocated blocks to avoid exposing stale
          * data.  If BH_New is set, we know that the block was newly
@@ -2096,9 +2094,12 @@ int block_read_full_page(struct page *page, get_block_t *get_block)
                         continue;
 
                 if (!buffer_mapped(bh)) {
+                        int err = 0;
+
                         fully_mapped = 0;
                         if (iblock < lblock) {
-                                if (get_block(inode, iblock, bh, 0))
+                                err = get_block(inode, iblock, bh, 0);
+                                if (err)
                                         SetPageError(page);
                         }
                         if (!buffer_mapped(bh)) {
@@ -2106,7 +2107,8 @@ int block_read_full_page(struct page *page, get_block_t *get_block)
                                 memset(kaddr + i * blocksize, 0, blocksize);
                                 flush_dcache_page(page);
                                 kunmap_atomic(kaddr, KM_USER0);
-                                set_buffer_uptodate(bh);
+                                if (!err)
+                                        set_buffer_uptodate(bh);
                                 continue;
                         }
                         /*
@@ -3115,7 +3117,7 @@ void __init buffer_init(void)
 
         bh_cachep = kmem_cache_create("buffer_head",
                         sizeof(struct buffer_head), 0,
-                        SLAB_PANIC, init_buffer_head, NULL);
+                        SLAB_RECLAIM_ACCOUNT|SLAB_PANIC, init_buffer_head, NULL);
 
         /*
          * Limit the bh occupancy to 10% of ZONE_NORMAL
diff --git a/fs/char_dev.c b/fs/char_dev.c
index a745b1d9e545..c1e3537909fc 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -328,7 +328,7 @@ void cd_forget(struct inode *inode)
         spin_unlock(&cdev_lock);
 }
 
-void cdev_purge(struct cdev *cdev)
+static void cdev_purge(struct cdev *cdev)
 {
         spin_lock(&cdev_lock);
         while (!list_empty(&cdev->list)) {
diff --git a/fs/cifs/README b/fs/cifs/README
index 7b4ac096cd11..e74df0c73256 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -32,9 +32,9 @@ the cifs download to your kernel build directory e.g.
 6) make modules (or "make" if CIFS VFS not to be built as a module)
 
 For Linux 2.6:
-1) Download the kernel (e.g. from http://www.kernel.org or from bitkeeper
-at bk://linux.bkbits.net/linux-2.5) and change directory into the top
-of the kernel directory tree (e.g. /usr/src/linux-2.5.73)
+1) Download the kernel (e.g. from http://www.kernel.org)
+and change directory into the top of the kernel directory tree
+(e.g. /usr/src/linux-2.5.73)
 2) make menuconfig (or make xconfig)
 3) select cifs from within the network filesystem choices
 4) save and exit
diff --git a/fs/dcache.c b/fs/dcache.c
index 496a4e08369c..3aa8a7e980d8 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -39,7 +39,7 @@ int sysctl_vfs_cache_pressure = 100;
 EXPORT_SYMBOL_GPL(sysctl_vfs_cache_pressure);
 
  __cacheline_aligned_in_smp DEFINE_SPINLOCK(dcache_lock);
-seqlock_t rename_lock __cacheline_aligned_in_smp = SEQLOCK_UNLOCKED;
+static seqlock_t rename_lock __cacheline_aligned_in_smp = SEQLOCK_UNLOCKED;
 
 EXPORT_SYMBOL(dcache_lock);
 
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 05b966cd6f76..9900e333655a 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -320,7 +320,7 @@ static struct super_block *eventpollfs_get_sb(struct file_system_type *fs_type,
 /*
  * This semaphore is used to serialize ep_free() and eventpoll_release_file().
  */
-struct semaphore epsem;
+static struct semaphore epsem;
 
 /* Safe wake up implementation */
 static struct poll_safewake psw;
diff --git a/fs/exec.c b/fs/exec.c
index a8394499926c..e56ee2437025 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -197,7 +197,8 @@ static int count(char __user * __user * argv, int max)
  * memory to free pages in kernel mem. These are in a format ready
  * to be put directly into the top of new user memory.
  */
-int copy_strings(int argc,char __user * __user * argv, struct linux_binprm *bprm)
+static int copy_strings(int argc, char __user * __user * argv,
+                        struct linux_binprm *bprm)
 {
         struct page *kmapped_page = NULL;
         char *kaddr = NULL;
@@ -868,9 +869,11 @@ int flush_old_exec(struct linux_binprm * bprm)
         if (current->euid == current->uid && current->egid == current->gid)
                 current->mm->dumpable = 1;
         name = bprm->filename;
+
+        /* Copies the binary name from after last slash */
         for (i=0; (ch = *(name++)) != '\0';) {
                 if (ch == '/')
-                        i = 0;
+                        i = 0; /* overwrite what we wrote */
                 else
                         if (i < (sizeof(tcomm) - 1))
                                 tcomm[i++] = ch;
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index ea5888688f94..0d5fa73b18dc 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -844,12 +844,6 @@ get_block:
         return ret;
 }
 
-static int ext3_writepages_get_block(struct inode *inode, sector_t iblock,
-                        struct buffer_head *bh, int create)
-{
-        return ext3_direct_io_get_blocks(inode, iblock, 1, bh, create);
-}
-
 /*
  * `handle' can be NULL if create is zero
  */
@@ -1323,45 +1317,6 @@ out_fail:
         return ret;
 }
 
-static int
-ext3_writeback_writepage_helper(struct page *page,
-                                struct writeback_control *wbc)
-{
-        return block_write_full_page(page, ext3_get_block, wbc);
-}
-
-static int
-ext3_writeback_writepages(struct address_space *mapping,
-                                struct writeback_control *wbc)
-{
-        struct inode *inode = mapping->host;
-        handle_t *handle = NULL;
-        int err, ret = 0;
-
-        if (!mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
-                return ret;
-
-        handle = ext3_journal_start(inode, ext3_writepage_trans_blocks(inode));
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                return ret;
-        }
-
-        ret = __mpage_writepages(mapping, wbc, ext3_writepages_get_block,
-                                        ext3_writeback_writepage_helper);
-
-        /*
-         * Need to reaquire the handle since ext3_writepages_get_block()
-         * can restart the handle
-         */
-        handle = journal_current_handle();
-
-        err = ext3_journal_stop(handle);
-        if (!ret)
-                ret = err;
-        return ret;
-}
-
 static int ext3_writeback_writepage(struct page *page,
                                 struct writeback_control *wbc)
 {
@@ -1599,7 +1554,6 @@ static struct address_space_operations ext3_writeback_aops = {
         .readpage       = ext3_readpage,
         .readpages      = ext3_readpages,
         .writepage      = ext3_writeback_writepage,
-        .writepages     = ext3_writeback_writepages,
         .sync_page      = block_sync_page,
         .prepare_write  = ext3_prepare_write,
         .commit_write   = ext3_writeback_commit_write,
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 545b440a2d2f..981ccb233ef5 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -225,8 +225,16 @@ void __ext3_std_error (struct super_block * sb, const char * function,
                        int errno)
 {
         char nbuf[16];
-        const char *errstr = ext3_decode_error(sb, errno, nbuf);
+        const char *errstr;
+
+        /* Special case: if the error is EROFS, and we're not already
+         * inside a transaction, then there's really no point in logging
+         * an error. */
+        if (errno == -EROFS && journal_current_handle() == NULL &&
+            (sb->s_flags & MS_RDONLY))
+                return;
 
+        errstr = ext3_decode_error(sb, errno, nbuf);
         printk (KERN_CRIT "EXT3-fs error (device %s) in %s: %s\n",
                 sb->s_id, function, errstr);
 
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index e6c63d9cac7b..14a0d339d036 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -991,13 +991,17 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent)
                 goto out_put;
 
         err = read_inode(root_inode);
-        if(err)
-                goto out_put;
+        if(err){
+                /* No iput in this case because the dput does that for us */
+                dput(sb->s_root);
+                sb->s_root = NULL;
+                goto out_free;
+        }
 
         return(0);
 
  out_put:
-        iput(root_inode);
+        iput(root_inode);
  out_free:
         kfree(name);
  out:
diff --git a/fs/inode.c b/fs/inode.c
index af8fd78d2099..801fe7f36280 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -26,7 +26,6 @@
  * This is needed for the following functions:
  *  - inode_has_buffers
  *  - invalidate_inode_buffers
- *  - fsync_bdev
  *  - invalidate_bdev
  *
  * FIXME: remove all knowledge of the buffer layer from this file
@@ -332,14 +331,6 @@ static int invalidate_list(struct list_head *head, struct list_head *dispose)
         return busy;
 }
 
-/*
- * This is a two-stage process. First we collect all
- * offending inodes onto the throw-away list, and in
- * the second stage we actually dispose of them. This
- * is because we don't want to sleep while messing
- * with the global lists..
- */
- 
 /**
  *      invalidate_inodes       - discard the inodes on a device
  *      @sb: superblock
@@ -366,16 +357,11 @@ int invalidate_inodes(struct super_block * sb)
 
 EXPORT_SYMBOL(invalidate_inodes);
  
-int __invalidate_device(struct block_device *bdev, int do_sync)
+int __invalidate_device(struct block_device *bdev)
 {
-        struct super_block *sb;
-        int res;
+        struct super_block *sb = get_super(bdev);
+        int res = 0;
 
-        if (do_sync)
-                fsync_bdev(bdev);
-
-        res = 0;
-        sb = get_super(bdev);
         if (sb) {
                 /*
                  * no need to lock the super, get_super holds the
@@ -390,7 +376,6 @@ int __invalidate_device(struct block_device *bdev, int do_sync)
         invalidate_bdev(bdev, 0);
         return res;
 }
-
 EXPORT_SYMBOL(__invalidate_device);
 
 static int can_unuse(struct inode *inode)
@@ -1336,7 +1321,7 @@ void __init inode_init(unsigned long mempages)
 
         /* inode slab cache */
         inode_cachep = kmem_cache_create("inode_cache", sizeof(struct inode),
-                                0, SLAB_PANIC, init_once, NULL);
+                                0, SLAB_RECLAIM_ACCOUNT|SLAB_PANIC, init_once, NULL);
         set_shrinker(DEFAULT_SEEKS, shrink_icache_memory);
 
         /* Hash may have been set up in inode_init_early */
diff --git a/fs/jffs2/compr_rubin.c b/fs/jffs2/compr_rubin.c
index 450d6624181f..09422388fb96 100644
--- a/fs/jffs2/compr_rubin.c
+++ b/fs/jffs2/compr_rubin.c
@@ -228,8 +228,10 @@ int jffs2_rubinmips_compress(unsigned char *data_in, unsigned char *cpage_out,
         return rubin_do_compress(BIT_DIVIDER_MIPS, bits_mips, data_in, cpage_out, sourcelen, dstlen);
 }
 #endif
-int jffs2_dynrubin_compress(unsigned char *data_in, unsigned char *cpage_out, 
-                   uint32_t *sourcelen, uint32_t *dstlen, void *model)
+static int jffs2_dynrubin_compress(unsigned char *data_in,
+                                   unsigned char *cpage_out,
+                                   uint32_t *sourcelen, uint32_t *dstlen,
+                                   void *model)
 {
         int bits[8];
         unsigned char histo[256];
@@ -306,15 +308,19 @@ static void rubin_do_decompress(int bit_divider, int *bits, unsigned char *cdata
 }                  
 
 
-int jffs2_rubinmips_decompress(unsigned char *data_in, unsigned char *cpage_out, 
-                   uint32_t sourcelen, uint32_t dstlen, void *model)
+static int jffs2_rubinmips_decompress(unsigned char *data_in,
+                                      unsigned char *cpage_out,
+                                      uint32_t sourcelen, uint32_t dstlen,
+                                      void *model)
 {
         rubin_do_decompress(BIT_DIVIDER_MIPS, bits_mips, data_in, cpage_out, sourcelen, dstlen);
         return 0;
 }
 
-int jffs2_dynrubin_decompress(unsigned char *data_in, unsigned char *cpage_out, 
-                   uint32_t sourcelen, uint32_t dstlen, void *model)
+static int jffs2_dynrubin_decompress(unsigned char *data_in,
+                                     unsigned char *cpage_out,
+                                     uint32_t sourcelen, uint32_t dstlen,
+                                     void *model)
 {
         int bits[8];
         int c;
diff --git a/fs/jffs2/compr_zlib.c b/fs/jffs2/compr_zlib.c
index 9f9932c22adb..078a30e406b5 100644
--- a/fs/jffs2/compr_zlib.c
+++ b/fs/jffs2/compr_zlib.c
@@ -69,8 +69,10 @@ static void free_workspaces(void)
 #define free_workspaces() do { } while(0)
 #endif /* __KERNEL__ */
 
-int jffs2_zlib_compress(unsigned char *data_in, unsigned char *cpage_out, 
-                   uint32_t *sourcelen, uint32_t *dstlen, void *model)
+static int jffs2_zlib_compress(unsigned char *data_in,
+                               unsigned char *cpage_out,
+                               uint32_t *sourcelen, uint32_t *dstlen,
+                               void *model)
 {
         int ret;
 
@@ -135,8 +137,10 @@ int jffs2_zlib_compress(unsigned char *data_in, unsigned char *cpage_out,
         return ret;
 }
 
-int jffs2_zlib_decompress(unsigned char *data_in, unsigned char *cpage_out,
-                      uint32_t srclen, uint32_t destlen, void *model)
+static int jffs2_zlib_decompress(unsigned char *data_in,
+                                 unsigned char *cpage_out,
+                                 uint32_t srclen, uint32_t destlen,
+                                 void *model)
 {
         int ret;
         int wbits = MAX_WBITS;
diff --git a/fs/locks.c b/fs/locks.c
index 1792ce547af7..3fa6a7ce57a7 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -406,12 +406,12 @@ static void lease_release_private_callback(struct file_lock *fl)
         fl->fl_file->f_owner.signum = 0;
 }
 
-int lease_mylease_callback(struct file_lock *fl, struct file_lock *try)
+static int lease_mylease_callback(struct file_lock *fl, struct file_lock *try)
 {
         return fl->fl_file == try->fl_file;
 }
 
-struct lock_manager_operations lease_manager_ops = {
+static struct lock_manager_operations lease_manager_ops = {
         .fl_break = lease_break_callback,
         .fl_release_private = lease_release_private_callback,
         .fl_mylease = lease_mylease_callback,
@@ -1274,7 +1274,7 @@ int fcntl_getlease(struct file *filp)
  *
  *      Called with kernel lock held.
  */
-int __setlease(struct file *filp, long arg, struct file_lock **flp)
+static int __setlease(struct file *filp, long arg, struct file_lock **flp)
 {
         struct file_lock *fl, **before, **my_before = NULL, *lease = *flp;
         struct dentry *dentry = filp->f_dentry;
diff --git a/fs/mbcache.c b/fs/mbcache.c
index f9e4d2700cd8..c7170b9221a3 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -57,7 +57,7 @@
 
 #define MB_CACHE_WRITER ((unsigned short)~0U >> 1)
 
-DECLARE_WAIT_QUEUE_HEAD(mb_cache_queue);
+static DECLARE_WAIT_QUEUE_HEAD(mb_cache_queue);
                 
 MODULE_AUTHOR("Andreas Gruenbacher <a.gruenbacher@computer.org>");
 MODULE_DESCRIPTION("Meta block cache (for extended attributes)");
diff --git a/fs/mpage.c b/fs/mpage.c
index 32c7c8fcfce7..b92c0e64aefa 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -87,7 +87,7 @@ static int mpage_end_io_write(struct bio *bio, unsigned int bytes_done, int err)
         return 0;
 }
 
-struct bio *mpage_bio_submit(int rw, struct bio *bio)
+static struct bio *mpage_bio_submit(int rw, struct bio *bio)
 {
         bio->bi_end_io = mpage_end_io_read;
         if (rw == WRITE)
@@ -627,15 +627,6 @@ int
 mpage_writepages(struct address_space *mapping,
                 struct writeback_control *wbc, get_block_t get_block)
 {
-        return __mpage_writepages(mapping, wbc, get_block,
-                mapping->a_ops->writepage);
-}
-
-int
-__mpage_writepages(struct address_space *mapping,
-                struct writeback_control *wbc, get_block_t get_block,
-                writepage_t writepage_fn)
-{
         struct backing_dev_info *bdi = mapping->backing_dev_info;
         struct bio *bio = NULL;
         sector_t last_block_in_bio = 0;
@@ -725,7 +716,7 @@ retry:
                         } else {
                                 bio = __mpage_writepage(bio, page, get_block,
                                                 &last_block_in_bio, &ret, wbc,
-                                                writepage_fn);
+                                                page->mapping->a_ops->writepage);
                         }
                         if (unlikely(ret == WRITEPAGE_ACTIVATE))
                                 unlock_page(page);
@@ -755,7 +746,6 @@ retry:
         return ret;
 }
 EXPORT_SYMBOL(mpage_writepages);
-EXPORT_SYMBOL(__mpage_writepages);
 
 int mpage_writepage(struct page *page, get_block_t get_block,
         struct writeback_control *wbc)
diff --git a/fs/namei.c b/fs/namei.c
index 0f76fd75591b..dd78f01b6de8 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1580,6 +1580,7 @@ enoent:
 fail:
         return dentry;
 }
+EXPORT_SYMBOL_GPL(lookup_create);
 
 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
 {
@@ -2071,8 +2072,8 @@ exit:
  *         ->i_sem on parents, which works but leads to some truely excessive
  *         locking].
  */
-int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
-               struct inode *new_dir, struct dentry *new_dentry)
+static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
+                          struct inode *new_dir, struct dentry *new_dentry)
 {
         int error = 0;
         struct inode *target;
@@ -2116,8 +2117,8 @@ int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
         return error;
 }
 
-int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
-               struct inode *new_dir, struct dentry *new_dentry)
+static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
+                            struct inode *new_dir, struct dentry *new_dentry)
 {
         struct inode *target;
         int error;
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index b74c4e3a64e2..87f4f9aeac86 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -79,7 +79,7 @@ static ssize_t   idmap_pipe_upcall(struct file *, struct rpc_pipe_msg *,
                      char __user *, size_t);
 static ssize_t   idmap_pipe_downcall(struct file *, const char __user *,
                      size_t);
-void             idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
+static void      idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
 
 static unsigned int fnvhash32(const void *, size_t);
 
@@ -434,7 +434,7 @@ out:
         return ret;
 }
 
-void
+static void
 idmap_pipe_destroy_msg(struct rpc_pipe_msg *msg)
 {
         struct idmap_msg *im = msg->data;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 6345f26e87ee..f2317f3e29f9 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1904,7 +1904,7 @@ static void init_once(void * foo, kmem_cache_t * cachep, unsigned long flags)
         }
 }
  
-int nfs_init_inodecache(void)
+static int nfs_init_inodecache(void)
 {
         nfs_inode_cachep = kmem_cache_create("nfs_inode_cache",
                                              sizeof(struct nfs_inode),
@@ -1916,7 +1916,7 @@ int nfs_init_inodecache(void)
         return 0;
 }
 
-void nfs_destroy_inodecache(void)
+static void nfs_destroy_inodecache(void)
 {
         if (kmem_cache_destroy(nfs_inode_cachep))
                 printk(KERN_INFO "nfs_inode_cache: not all structures were freed\n");
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
index 897512796edb..a912debcd20b 100644
--- a/fs/nls/nls_base.c
+++ b/fs/nls/nls_base.c
@@ -243,7 +243,7 @@ void unload_nls(struct nls_table *nls)
         module_put(nls->owner);
 }
 
-wchar_t charset2uni[256] = {
+static wchar_t charset2uni[256] = {
         /* 0x00*/
         0x0000, 0x0001, 0x0002, 0x0003,
         0x0004, 0x0005, 0x0006, 0x0007,
diff --git a/fs/partitions/msdos.c b/fs/partitions/msdos.c
index 17ee1b4ff087..584a27b2bbd5 100644
--- a/fs/partitions/msdos.c
+++ b/fs/partitions/msdos.c
@@ -114,9 +114,6 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
                  */
                 for (i=0; i<4; i++, p++) {
                         u32 offs, size, next;
-
-                        if (SYS_IND(p) == 0)
-                                continue;
                         if (!NR_SECTS(p) || is_extended_partition(p))
                                 continue;
 
@@ -433,8 +430,6 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
         for (slot = 1 ; slot <= 4 ; slot++, p++) {
                 u32 start = START_SECT(p)*sector_size;
                 u32 size = NR_SECTS(p)*sector_size;
-                if (SYS_IND(p) == 0)
-                        continue;
                 if (!size)
                         continue;
                 if (is_extended_partition(p)) {
diff --git a/fs/proc/mmu.c b/fs/proc/mmu.c
index a7041038ad56..25d2d9c6e329 100644
--- a/fs/proc/mmu.c
+++ b/fs/proc/mmu.c
@@ -50,13 +50,23 @@ void get_vmalloc_info(struct vmalloc_info *vmi)
                 read_lock(&vmlist_lock);
 
                 for (vma = vmlist; vma; vma = vma->next) {
+                        unsigned long addr = (unsigned long) vma->addr;
+
+                        /*
+                         * Some archs keep another range for modules in vmlist
+                         */
+                        if (addr < VMALLOC_START)
+                                continue;
+                        if (addr >= VMALLOC_END)
+                                break;
+
                         vmi->used += vma->size;
 
-                        free_area_size = (unsigned long) vma->addr - prev_end;
+                        free_area_size = addr - prev_end;
                         if (vmi->largest_chunk < free_area_size)
                                 vmi->largest_chunk = free_area_size;
 
-                        prev_end = vma->size + (unsigned long) vma->addr;
+                        prev_end = vma->size + addr;
                 }
 
                 if (VMALLOC_END - prev_end > vmi->largest_chunk)
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index 80e92d9b81cb..7d4dc5f5aa8b 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -608,7 +608,7 @@ static int reiserfs_create (struct inode * dir, struct dentry *dentry, int mode,
         goto out_failed;
     }
 
-    retval = reiserfs_new_inode (&th, dir, mode, 0, 0/*i_size*/, dentry, inode);
+    retval = reiserfs_new_inode (&th, dir, mode, NULL, 0/*i_size*/, dentry, inode);
     if (retval)
         goto out_failed;
         
diff --git a/fs/select.c b/fs/select.c
index 25b1ccac2f2c..b80e7eb0ac0d 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -55,7 +55,8 @@ struct poll_table_page {
  * as all select/poll functions have to call it to add an entry to the
  * poll table.
  */
-void __pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p);
+static void __pollwait(struct file *filp, wait_queue_head_t *wait_address,
+                       poll_table *p);
 
 void poll_initwait(struct poll_wqueues *pwq)
 {
@@ -87,7 +88,8 @@ void poll_freewait(struct poll_wqueues *pwq)
 
 EXPORT_SYMBOL(poll_freewait);
 
-void __pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *_p)
+static void __pollwait(struct file *filp, wait_queue_head_t *wait_address,
+                       poll_table *_p)
 {
         struct poll_wqueues *p = container_of(_p, struct poll_wqueues, pt);
         struct poll_table_page *table = p->table;
diff --git a/fs/udf/udftime.c b/fs/udf/udftime.c
index c2634bda6b50..457a8fe28575 100644
--- a/fs/udf/udftime.c
+++ b/fs/udf/udftime.c
@@ -103,7 +103,7 @@ udf_stamp_to_time(time_t *dest, long *dest_usec, kernel_timestamp src)
                 offset = 0;
 
         if ((src.year < EPOCH_YEAR) ||
-                (src.year > EPOCH_YEAR+MAX_YEAR_SECONDS))
+                (src.year >= EPOCH_YEAR+MAX_YEAR_SECONDS))
         {
                 *dest = -1;
                 *dest_usec = -1;
diff --git a/fs/xfs/Makefile b/fs/xfs/Makefile
index 554e4a18c152..d3ff78354638 100644
--- a/fs/xfs/Makefile
+++ b/fs/xfs/Makefile
@@ -49,7 +49,7 @@ ifeq ($(CONFIG_XFS_TRACE),y)
         EXTRA_CFLAGS += -DXFS_LOG_TRACE
         EXTRA_CFLAGS += -DXFS_RW_TRACE
         EXTRA_CFLAGS += -DPAGEBUF_TRACE
-        # EXTRA_CFLAGS += -DXFS_VNODE_TRACE
+        EXTRA_CFLAGS += -DXFS_VNODE_TRACE
 endif
 
 obj-$(CONFIG_XFS_FS)            += xfs.o
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 76a84758073a..9278e9aba9ba 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -558,7 +558,8 @@ xfs_submit_page(
         int                     i;
 
         BUG_ON(PageWriteback(page));
-        set_page_writeback(page);
+        if (bh_count)
+                set_page_writeback(page);
         if (clear_dirty)
                 clear_page_dirty(page);
         unlock_page(page);
@@ -578,9 +579,6 @@ xfs_submit_page(
 
                 if (probed_page && clear_dirty)
                         wbc->nr_to_write--;     /* Wrote an "extra" page */
-        } else {
-                end_page_writeback(page);
-                wbc->pages_skipped++;   /* We didn't write this page */
         }
 }
 
@@ -602,21 +600,26 @@ xfs_convert_page(
 {
         struct buffer_head      *bh_arr[MAX_BUF_PER_PAGE], *bh, *head;
         xfs_iomap_t             *mp = iomapp, *tmp;
-        unsigned long           end, offset;
-        pgoff_t                 end_index;
-        int                     i = 0, index = 0;
+        unsigned long           offset, end_offset;
+        int                     index = 0;
         int                     bbits = inode->i_blkbits;
+        int                     len, page_dirty;
 
-        end_index = i_size_read(inode) >> PAGE_CACHE_SHIFT;
-        if (page->index < end_index) {
-                end = PAGE_CACHE_SIZE;
-        } else {
-                end = i_size_read(inode) & (PAGE_CACHE_SIZE-1);
-        }
+        end_offset = (i_size_read(inode) & (PAGE_CACHE_SIZE - 1));
+
+        /*
+         * page_dirty is initially a count of buffers on the page before
+         * EOF and is decrememted as we move each into a cleanable state.
+         */
+        len = 1 << inode->i_blkbits;
+        end_offset = max(end_offset, PAGE_CACHE_SIZE);
+        end_offset = roundup(end_offset, len);
+        page_dirty = end_offset / len;
+
+        offset = 0;
         bh = head = page_buffers(page);
         do {
-                offset = i << bbits;
-                if (offset >= end)
+                if (offset >= end_offset)
                         break;
                 if (!(PageUptodate(page) || buffer_uptodate(bh)))
                         continue;
@@ -625,6 +628,7 @@ xfs_convert_page(
                         if (startio) {
                                 lock_buffer(bh);
                                 bh_arr[index++] = bh;
+                                page_dirty--;
                         }
                         continue;
                 }
@@ -657,10 +661,11 @@ xfs_convert_page(
                         unlock_buffer(bh);
                         mark_buffer_dirty(bh);
                 }
-        } while (i++, (bh = bh->b_this_page) != head);
+                page_dirty--;
+        } while (offset += len, (bh = bh->b_this_page) != head);
 
-        if (startio) {
-                xfs_submit_page(page, wbc, bh_arr, index, 1, index == i);
+        if (startio && index) {
+                xfs_submit_page(page, wbc, bh_arr, index, 1, !page_dirty);
         } else {
                 unlock_page(page);
         }
@@ -725,8 +730,11 @@ xfs_page_state_convert(
         __uint64_t              end_offset;
         pgoff_t                 end_index, last_index, tlast;
         int                     len, err, i, cnt = 0, uptodate = 1;
-        int                     flags = startio ? 0 : BMAPI_TRYLOCK;
-        int                     page_dirty, delalloc = 0;
+        int                     flags;
+        int                     page_dirty;
+
+        /* wait for other IO threads? */
+        flags = (startio && wbc->sync_mode != WB_SYNC_NONE) ? 0 : BMAPI_TRYLOCK;
 
         /* Is this page beyond the end of the file? */
         offset = i_size_read(inode);
@@ -740,19 +748,22 @@ xfs_page_state_convert(
                 }
         }
 
-        offset = (loff_t)page->index << PAGE_CACHE_SHIFT;
         end_offset = min_t(unsigned long long,
-                        offset + PAGE_CACHE_SIZE, i_size_read(inode));
-
-        bh = head = page_buffers(page);
-        iomp = NULL;
+                        (loff_t)(page->index + 1) << PAGE_CACHE_SHIFT, offset);
+        offset = (loff_t)page->index << PAGE_CACHE_SHIFT;
 
         /*
-         * page_dirty is initially a count of buffers on the page and
-         * is decrememted as we move each into a cleanable state.
+         * page_dirty is initially a count of buffers on the page before
+         * EOF and is decrememted as we move each into a cleanable state.
          */
-        len = bh->b_size;
-        page_dirty = PAGE_CACHE_SIZE / len;
+        len = 1 << inode->i_blkbits;
+        p_offset = max(p_offset, PAGE_CACHE_SIZE);
+        p_offset = roundup(p_offset, len);
+        page_dirty = p_offset / len;
+
+        iomp = NULL;
+        p_offset = 0;
+        bh = head = page_buffers(page);
 
         do {
                 if (offset >= end_offset)
@@ -804,7 +815,6 @@ xfs_page_state_convert(
                  */
                 } else if (buffer_delay(bh)) {
                         if (!iomp) {
-                                delalloc = 1;
                                 err = xfs_map_blocks(inode, offset, len, &iomap,
                                                 BMAPI_ALLOCATE | flags);
                                 if (err) {
@@ -875,14 +885,15 @@ xfs_page_state_convert(
         if (uptodate && bh == head)
                 SetPageUptodate(page);
 
-        if (startio)
-                xfs_submit_page(page, wbc, bh_arr, cnt, 0, 1);
+        if (startio) {
+                WARN_ON(page_dirty);
+                xfs_submit_page(page, wbc, bh_arr, cnt, 0, !page_dirty);
+        }
 
         if (iomp) {
-                tlast = (iomp->iomap_offset + iomp->iomap_bsize - 1) >>
+                offset = (iomp->iomap_offset + iomp->iomap_bsize - 1) >>
                                         PAGE_CACHE_SHIFT;
-                if (delalloc && (tlast > last_index))
-                        tlast = last_index;
+                tlast = min_t(pgoff_t, offset, last_index);
                 xfs_cluster_write(inode, page->index + 1, iomp, wbc,
                                         startio, unmapped, tlast);
         }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 23e0eb67fc25..997963e53622 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -1746,13 +1746,15 @@ STATIC DECLARE_COMPLETION(pagebuf_daemon_done);
 STATIC struct task_struct *pagebuf_daemon_task;
 STATIC int pagebuf_daemon_active;
 STATIC int force_flush;
-
+STATIC int force_sleep;
 
 STATIC int
 pagebuf_daemon_wakeup(
         int                     priority,
         unsigned int            mask)
 {
+        if (force_sleep)
+                return 0;
         force_flush = 1;
         barrier();
         wake_up_process(pagebuf_daemon_task);
@@ -1778,7 +1780,12 @@ pagebuf_daemon(
 
         INIT_LIST_HEAD(&tmp);
         do {
-                try_to_freeze(PF_FREEZE);
+                if (unlikely(current->flags & PF_FREEZE)) {
+                        force_sleep = 1;
+                        refrigerator(PF_FREEZE);
+                } else {
+                        force_sleep = 0;
+                }
 
                 set_current_state(TASK_INTERRUPTIBLE);
                 schedule_timeout((xfs_buf_timer_centisecs * HZ) / 100);
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 9f057a4a5b06..d0d412afd261 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -515,10 +515,49 @@ open_exec_out:
 }
 #endif /* HAVE_FOP_OPEN_EXEC */
 
+/*
+ * Temporary workaround to the AIO direct IO write problem.
+ * This code can go and we can revert to do_sync_write once
+ * the writepage(s) rework is merged.
+ */
+STATIC ssize_t
+linvfs_write(
+        struct file     *filp,
+        const char      __user *buf,
+        size_t          len,
+        loff_t          *ppos)
+{
+        struct kiocb    kiocb;
+        ssize_t         ret;
+
+        init_sync_kiocb(&kiocb, filp);
+        kiocb.ki_pos = *ppos;
+        ret = __linvfs_write(&kiocb, buf, 0, len, kiocb.ki_pos);
+        *ppos = kiocb.ki_pos;
+        return ret;
+}
+STATIC ssize_t
+linvfs_write_invis(
+        struct file     *filp,
+        const char      __user *buf,
+        size_t          len,
+        loff_t          *ppos)
+{
+        struct kiocb    kiocb;
+        ssize_t         ret;
+
+        init_sync_kiocb(&kiocb, filp);
+        kiocb.ki_pos = *ppos;
+        ret = __linvfs_write(&kiocb, buf, IO_INVIS, len, kiocb.ki_pos);
+        *ppos = kiocb.ki_pos;
+        return ret;
+}
+
+
 struct file_operations linvfs_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
-        .write          = do_sync_write,
+        .write          = linvfs_write,
         .readv          = linvfs_readv,
         .writev         = linvfs_writev,
         .aio_read       = linvfs_aio_read,
@@ -540,7 +579,7 @@ struct file_operations linvfs_file_operations = {
 struct file_operations linvfs_invis_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
-        .write          = do_sync_write,
+        .write          = linvfs_write_invis,
         .readv          = linvfs_readv_invis,
         .writev         = linvfs_writev_invis,
         .aio_read       = linvfs_aio_read_invis,
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index ff145fd0d1a4..aa9daaea6c34 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -683,6 +683,9 @@ xfs_write(
                         (xip->i_d.di_flags & XFS_DIFLAG_REALTIME) ?
                                 mp->m_rtdev_targp : mp->m_ddev_targp;
 
+                if (ioflags & IO_ISAIO)
+                        return XFS_ERROR(-ENOSYS);
+
                 if ((pos & target->pbr_smask) || (count & target->pbr_smask))
                         return XFS_ERROR(-EINVAL);
 
diff --git a/fs/xfs/linux-2.6/xfs_vnode.c b/fs/xfs/linux-2.6/xfs_vnode.c
index 849c61c74f3c..a832d165f24f 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.c
+++ b/fs/xfs/linux-2.6/xfs_vnode.c
@@ -156,7 +156,6 @@ vn_initialize(
 
 #ifdef  XFS_VNODE_TRACE
         vp->v_trace = ktrace_alloc(VNODE_TRACE_SIZE, KM_SLEEP);
-        printk("Allocated VNODE_TRACE at 0x%p\n", vp->v_trace);
 #endif  /* XFS_VNODE_TRACE */
 
         vn_trace_exit(vp, "vn_initialize", (inst_t *)__return_address);
@@ -424,13 +423,13 @@ vn_remove(
  * Vnode tracing code.
  */
 void
-vn_trace_entry(vnode_t *vp, char *func, inst_t *ra)
+vn_trace_entry(vnode_t *vp, const char *func, inst_t *ra)
 {
         KTRACE_ENTER(vp, VNODE_KTRACE_ENTRY, func, 0, ra);
 }
 
 void
-vn_trace_exit(vnode_t *vp, char *func, inst_t *ra)
+vn_trace_exit(vnode_t *vp, const char *func, inst_t *ra)
 {
         KTRACE_ENTER(vp, VNODE_KTRACE_EXIT, func, 0, ra);
 }
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/linux-2.6/xfs_vnode.h
index da76c1f1e11c..00466c3194ac 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/linux-2.6/xfs_vnode.h
@@ -86,10 +86,11 @@ typedef struct vnode {
         vnumber_t       v_number;               /* in-core vnode number */
         vn_bhv_head_t   v_bh;                   /* behavior head */
         spinlock_t      v_lock;                 /* VN_LOCK/VN_UNLOCK */
-        struct inode    v_inode;                /* Linux inode */
 #ifdef XFS_VNODE_TRACE
         struct ktrace   *v_trace;               /* trace header structure    */
 #endif
+        struct inode    v_inode;                /* Linux inode */
+        /* inode MUST be last */
 } vnode_t;
 
 #define v_fbhv                  v_bh.bh_first          /* first behavior */
@@ -409,7 +410,7 @@ typedef struct vattr {
         int             va_mask;        /* bit-mask of attributes present */
         enum vtype      va_type;        /* vnode type (for create) */
         mode_t          va_mode;        /* file access mode and type */
-        nlink_t         va_nlink;       /* number of references to file */
+        xfs_nlink_t     va_nlink;       /* number of references to file */
         uid_t           va_uid;         /* owner user id */
         gid_t           va_gid;         /* owner group id */
         xfs_ino_t       va_nodeid;      /* file id */
@@ -625,6 +626,7 @@ static inline int VN_BAD(struct vnode *vp)
 #define ATTR_DMI        0x08    /* invocation from a DMI function */
 #define ATTR_LAZY       0x80    /* set/get attributes lazily */
 #define ATTR_NONBLOCK   0x100   /* return EAGAIN if operation would block */
+#define ATTR_NOLOCK     0x200   /* Don't grab any conflicting locks */
 
 /*
  * Flags to VOP_FSYNC and VOP_RECLAIM.
@@ -646,8 +648,8 @@ static inline int VN_BAD(struct vnode *vp)
 #define VNODE_KTRACE_REF        4
 #define VNODE_KTRACE_RELE       5
 
-extern void vn_trace_entry(struct vnode *, char *, inst_t *);
-extern void vn_trace_exit(struct vnode *, char *, inst_t *);
+extern void vn_trace_entry(struct vnode *, const char *, inst_t *);
+extern void vn_trace_exit(struct vnode *, const char *, inst_t *);
 extern void vn_trace_hold(struct vnode *, char *, int, inst_t *);
 extern void vn_trace_ref(struct vnode *, char *, int, inst_t *);
 extern void vn_trace_rele(struct vnode *, char *, int, inst_t *);
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 08d551a17347..63abdc2ac7f4 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -182,7 +182,7 @@ xfs_swapext(
 
         if (VN_CACHED(tvp) != 0)
                 xfs_inval_cached_pages(XFS_ITOV(tip), &(tip->i_iocore),
-                                                (loff_t)0, 0, 0);
+                                                (xfs_off_t)0, 0, 0);
 
         /* Verify O_DIRECT for ftmp */
         if (VN_CACHED(tvp) != 0) {
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 3a0ba1dfd0e8..d3da00045f26 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -136,6 +136,40 @@ xfs_chash_free(xfs_mount_t *mp)
 }
 
 /*
+ * Try to move an inode to the front of its hash list if possible
+ * (and if its not there already).  Called right after obtaining
+ * the list version number and then dropping the read_lock on the
+ * hash list in question (which is done right after looking up the
+ * inode in question...).
+ */
+STATIC void
+xfs_ihash_promote(
+        xfs_ihash_t     *ih,
+        xfs_inode_t     *ip,
+        ulong           version)
+{
+        xfs_inode_t     *iq;
+
+        if ((ip->i_prevp != &ih->ih_next) && write_trylock(&ih->ih_lock)) {
+                if (likely(version == ih->ih_version)) {
+                        /* remove from list */
+                        if ((iq = ip->i_next)) {
+                                iq->i_prevp = ip->i_prevp;
+                        }
+                        *ip->i_prevp = iq;
+
+                        /* insert at list head */
+                        iq = ih->ih_next;
+                        iq->i_prevp = &ip->i_next;
+                        ip->i_next = iq;
+                        ip->i_prevp = &ih->ih_next;
+                        ih->ih_next = ip;
+                }
+                write_unlock(&ih->ih_lock);
+        }
+}
+
+/*
  * Look up an inode by number in the given file system.
  * The inode is looked up in the hash table for the file system
  * represented by the mount point parameter mp.  Each bucket of
@@ -229,7 +263,9 @@ again:
                                 XFS_STATS_INC(xs_ig_found);
 
                                 ip->i_flags &= ~XFS_IRECLAIMABLE;
+                                version = ih->ih_version;
                                 read_unlock(&ih->ih_lock);
+                                xfs_ihash_promote(ih, ip, version);
 
                                 XFS_MOUNT_ILOCK(mp);
                                 list_del_init(&ip->i_reclaim);
@@ -259,8 +295,15 @@ again:
                                                 inode_vp, vp);
                         }
 
+                        /*
+                         * Inode cache hit: if ip is not at the front of
+                         * its hash chain, move it there now.
+                         * Do this with the lock held for update, but
+                         * do statistics after releasing the lock.
+                         */
+                        version = ih->ih_version;
                         read_unlock(&ih->ih_lock);
-
+                        xfs_ihash_promote(ih, ip, version);
                         XFS_STATS_INC(xs_ig_found);
 
 finish_inode:
@@ -547,6 +590,7 @@ xfs_inode_incore(xfs_mount_t	*mp,
 {
         xfs_ihash_t     *ih;
         xfs_inode_t     *ip;
+        ulong           version;
 
         ih = XFS_IHASH(mp, ino);
         read_lock(&ih->ih_lock);
@@ -554,11 +598,15 @@ xfs_inode_incore(xfs_mount_t	*mp,
                 if (ip->i_ino == ino) {
                         /*
                          * If we find it and tp matches, return it.
+                         * Also move it to the front of the hash list
+                         * if we find it and it is not already there.
                          * Otherwise break from the loop and return
                          * NULL.
                          */
                         if (ip->i_transp == tp) {
+                                version = ih->ih_version;
                                 read_unlock(&ih->ih_lock);
+                                xfs_ihash_promote(ih, ip, version);
                                 return (ip);
                         }
                         break;
@@ -685,6 +733,7 @@ xfs_iextract(
                 iq->i_prevp = ip->i_prevp;
         }
         *ip->i_prevp = iq;
+        ih->ih_version++;
         write_unlock(&ih->ih_lock);
 
         /*
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 43c632ab86ad..bc8c8c7f9039 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -1130,7 +1130,7 @@ xfs_ialloc(
         xfs_trans_t     *tp,
         xfs_inode_t     *pip,
         mode_t          mode,
-        nlink_t         nlink,
+        xfs_nlink_t     nlink,
         xfs_dev_t       rdev,
         cred_t          *cr,
         xfs_prid_t      prid,
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index a53b1ccf6070..37e1c316f3b6 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -495,9 +495,9 @@ int		xfs_itobp(struct xfs_mount *, struct xfs_trans *,
 int             xfs_iread(struct xfs_mount *, struct xfs_trans *, xfs_ino_t,
                           xfs_inode_t **, xfs_daddr_t);
 int             xfs_iread_extents(struct xfs_trans *, xfs_inode_t *, int);
-int             xfs_ialloc(struct xfs_trans *, xfs_inode_t *, mode_t, nlink_t,
-                           xfs_dev_t, struct cred *, xfs_prid_t, int,
-                           struct xfs_buf **, boolean_t *, xfs_inode_t **);
+int             xfs_ialloc(struct xfs_trans *, xfs_inode_t *, mode_t,
+                           xfs_nlink_t, xfs_dev_t, struct cred *, xfs_prid_t,
+                           int, struct xfs_buf **, boolean_t *, xfs_inode_t **);
 void            xfs_xlate_dinode_core(xfs_caddr_t, struct xfs_dinode_core *,
                                         int);
 uint            xfs_ip2xflags(struct xfs_inode *);
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 3826e8f0e28a..991f8a61f7c4 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -308,7 +308,8 @@ phase2:
                         break;
                 }
 
-                error = XFS_IOMAP_WRITE_ALLOCATE(mp, io, &imap, &nimaps);
+                error = XFS_IOMAP_WRITE_ALLOCATE(mp, io, offset, count,
+                                                 &imap, &nimaps);
                 break;
         case BMAPI_UNWRITTEN:
                 lockmode = 0;
@@ -365,7 +366,7 @@ xfs_flush_space(
 int
 xfs_iomap_write_direct(
         xfs_inode_t     *ip,
-        loff_t          offset,
+        xfs_off_t       offset,
         size_t          count,
         int             flags,
         xfs_bmbt_irec_t *ret_imap,
@@ -541,7 +542,7 @@ error_out:
 int
 xfs_iomap_write_delay(
         xfs_inode_t     *ip,
-        loff_t          offset,
+        xfs_off_t       offset,
         size_t          count,
         int             ioflag,
         xfs_bmbt_irec_t *ret_imap,
@@ -746,6 +747,8 @@ write_map:
 int
 xfs_iomap_write_allocate(
         xfs_inode_t     *ip,
+        xfs_off_t       offset,
+        size_t          count,
         xfs_bmbt_irec_t *map,
         int             *retmap)
 {
@@ -770,9 +773,9 @@ xfs_iomap_write_allocate(
         if ((error = XFS_QM_DQATTACH(mp, ip, 0)))
                 return XFS_ERROR(error);
 
-        offset_fsb = map->br_startoff;
+        offset_fsb = XFS_B_TO_FSBT(mp, offset);
         count_fsb = map->br_blockcount;
-        map_start_fsb = offset_fsb;
+        map_start_fsb = map->br_startoff;
 
         XFS_STATS_ADD(xs_xstrat_bytes, XFS_FSB_TO_B(mp, count_fsb));
 
@@ -868,9 +871,9 @@ xfs_iomap_write_allocate(
                                         imap[i].br_startoff,
                                         imap[i].br_blockcount,imap[i].br_state);
                         }
-                        if ((map->br_startoff >= imap[i].br_startoff) &&
-                            (map->br_startoff < (imap[i].br_startoff +
-                                                 imap[i].br_blockcount))) {
+                        if ((offset_fsb >= imap[i].br_startoff) &&
+                            (offset_fsb < (imap[i].br_startoff +
+                                           imap[i].br_blockcount))) {
                                 *map = imap[i];
                                 *retmap = 1;
                                 XFS_STATS_INC(xs_xstrat_quick);
@@ -883,9 +886,8 @@ xfs_iomap_write_allocate(
                  * file, just surrounding data, try again.
                  */
                 nimaps--;
-                offset_fsb = imap[nimaps].br_startoff +
-                             imap[nimaps].br_blockcount;
-                map_start_fsb = offset_fsb;
+                map_start_fsb = imap[nimaps].br_startoff +
+                                imap[nimaps].br_blockcount;
         }
 
 trans_cancel:
@@ -899,7 +901,7 @@ error0:
 int
 xfs_iomap_write_unwritten(
         xfs_inode_t     *ip,
-        loff_t          offset,
+        xfs_off_t       offset,
         size_t          count)
 {
         xfs_mount_t     *mp = ip->i_mount;
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index 31c91087cb33..4daaa5212102 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003,2004 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2003-2005 Silicon Graphics, Inc.  All Rights Reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -29,9 +29,6 @@
  *
  * http://oss.sgi.com/projects/GenInfo/SGIGPLNoticeExplan/
  */
-
-
-
 #ifndef __XFS_IOMAP_H__
 #define __XFS_IOMAP_H__
 
@@ -56,7 +53,7 @@ typedef enum {
         BMAPI_UNWRITTEN  = (1 << 3),    /* unwritten extents to real extents */
         /* modifiers */
         BMAPI_IGNSTATE = (1 << 4),      /* ignore unwritten state on read */
-        BMAPI_DIRECT = (1 << 5),                /* direct instead of buffered write */
+        BMAPI_DIRECT = (1 << 5),        /* direct instead of buffered write */
         BMAPI_MMAP = (1 << 6),          /* allocate for mmap write */
         BMAPI_SYNC = (1 << 7),          /* sync write to flush delalloc space */
         BMAPI_TRYLOCK = (1 << 8),       /* non-blocking request */
@@ -67,13 +64,13 @@ typedef enum {
 /*
  * xfs_iomap_t:  File system I/O map
  *
- * The iomap_bn field is expressed in 512-byte blocks, and is where the 
+ * The iomap_bn field is expressed in 512-byte blocks, and is where the
  * mapping starts on disk.
  *
  * The iomap_offset, iomap_bsize and iomap_delta fields are in bytes.
  * iomap_offset is the offset of the mapping in the file itself.
- * iomap_bsize is the size of the mapping,  iomap_delta is the 
- * desired data's offset into the mapping, given the offset supplied 
+ * iomap_bsize is the size of the mapping,  iomap_delta is the
+ * desired data's offset into the mapping, given the offset supplied
  * to the file I/O map routine.
  *
  * When a request is made to read beyond the logical end of the object,
@@ -84,8 +81,8 @@ typedef enum {
 typedef struct xfs_iomap {
         xfs_daddr_t             iomap_bn;       /* first 512b blk of mapping */
         xfs_buftarg_t           *iomap_target;
-        loff_t                  iomap_offset;   /* offset of mapping, bytes */
-        loff_t                  iomap_bsize;    /* size of mapping, bytes */
+        xfs_off_t               iomap_offset;   /* offset of mapping, bytes */
+        xfs_off_t               iomap_bsize;    /* size of mapping, bytes */
         size_t                  iomap_delta;    /* offset into mapping, bytes */
         iomap_flags_t           iomap_flags;
 } xfs_iomap_t;
@@ -96,12 +93,12 @@ struct xfs_bmbt_irec;
 
 extern int xfs_iomap(struct xfs_iocore *, xfs_off_t, ssize_t, int,
                      struct xfs_iomap *, int *);
-extern int xfs_iomap_write_direct(struct xfs_inode *, loff_t, size_t,
+extern int xfs_iomap_write_direct(struct xfs_inode *, xfs_off_t, size_t,
                                   int, struct xfs_bmbt_irec *, int *, int);
-extern int xfs_iomap_write_delay(struct xfs_inode *, loff_t, size_t, int,
+extern int xfs_iomap_write_delay(struct xfs_inode *, xfs_off_t, size_t, int,
                                  struct xfs_bmbt_irec *, int *);
-extern int xfs_iomap_write_allocate(struct xfs_inode *,
+extern int xfs_iomap_write_allocate(struct xfs_inode *, xfs_off_t, size_t,
                                 struct xfs_bmbt_irec *, int *);
-extern int xfs_iomap_write_unwritten(struct xfs_inode *, loff_t, size_t);
+extern int xfs_iomap_write_unwritten(struct xfs_inode *, xfs_off_t, size_t);
 
 #endif /* __XFS_IOMAP_H__*/
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index b57423caef9b..2ec967d93e5a 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -301,6 +301,15 @@ xfs_mount_validate_sb(
         }
 
         /*
+         * Version 1 directory format has never worked on Linux.
+         */
+        if (unlikely(!XFS_SB_VERSION_HASDIRV2(sbp))) {
+                cmn_err(CE_WARN,
+        "XFS: Attempted to mount file system using version 1 directory format");
+                return XFS_ERROR(ENOSYS);
+        }
+
+        /*
          * Until this is fixed only page-sized or smaller data blocks work.
          */
         if (unlikely(sbp->sb_blocksize > PAGE_SIZE)) {
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 5fc6201dd8e2..30dd08fb9f57 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -210,15 +210,16 @@ typedef int		(*xfs_bmapi_t)(struct xfs_trans *, void *,
                                 struct xfs_bmap_free *);
 typedef int             (*xfs_bmap_eof_t)(void *, xfs_fileoff_t, int, int *);
 typedef int             (*xfs_iomap_write_direct_t)(
-                                void *, loff_t, size_t, int,
+                                void *, xfs_off_t, size_t, int,
                                 struct xfs_bmbt_irec *, int *, int);
 typedef int             (*xfs_iomap_write_delay_t)(
-                                void *, loff_t, size_t, int,
+                                void *, xfs_off_t, size_t, int,
                                 struct xfs_bmbt_irec *, int *);
 typedef int             (*xfs_iomap_write_allocate_t)(
-                                void *, struct xfs_bmbt_irec *, int *);
+                                void *, xfs_off_t, size_t,
+                                struct xfs_bmbt_irec *, int *);
 typedef int             (*xfs_iomap_write_unwritten_t)(
-                                void *, loff_t, size_t);
+                                void *, xfs_off_t, size_t);
 typedef uint            (*xfs_lck_map_shared_t)(void *);
 typedef void            (*xfs_lock_t)(void *, uint);
 typedef void            (*xfs_lock_demote_t)(void *, uint);
@@ -258,9 +259,9 @@ typedef struct xfs_ioops {
 #define XFS_IOMAP_WRITE_DELAY(mp, io, offset, count, flags, mval, nmap) \
         (*(mp)->m_io_ops.xfs_iomap_write_delay) \
                 ((io)->io_obj, offset, count, flags, mval, nmap)
-#define XFS_IOMAP_WRITE_ALLOCATE(mp, io, mval, nmap) \
+#define XFS_IOMAP_WRITE_ALLOCATE(mp, io, offset, count, mval, nmap) \
         (*(mp)->m_io_ops.xfs_iomap_write_allocate) \
-                ((io)->io_obj, mval, nmap)
+                ((io)->io_obj, offset, count, mval, nmap)
 #define XFS_IOMAP_WRITE_UNWRITTEN(mp, io, offset, count) \
         (*(mp)->m_io_ops.xfs_iomap_write_unwritten) \
                 ((io)->io_obj, offset, count)
@@ -428,10 +429,10 @@ typedef struct xfs_mount {
 #define XFS_WRITEIO_LOG_LARGE   16
 
 /*
- * Max and min values for UIO and mount-option defined I/O sizes;
- * min value can't be less than a page.  Currently unused.
+ * Max and min values for mount-option defined I/O
+ * preallocation sizes.
  */
-#define XFS_MAX_IO_LOG          16      /* 64K */
+#define XFS_MAX_IO_LOG          30      /* 1G */
 #define XFS_MIN_IO_LOG          PAGE_SHIFT
 
 /*
diff --git a/fs/xfs/xfs_types.h b/fs/xfs/xfs_types.h
index 04609d27ea51..e4bf711e48ff 100644
--- a/fs/xfs/xfs_types.h
+++ b/fs/xfs/xfs_types.h
@@ -63,6 +63,7 @@ typedef __u64			xfs_ino_t;	/* <inode> type */
 typedef __s64                   xfs_daddr_t;    /* <disk address> type */
 typedef char *                  xfs_caddr_t;    /* <core address> type */
 typedef __u32                   xfs_dev_t;
+typedef __u32                   xfs_nlink_t;
 
 /* __psint_t is the same size as a pointer */
 #if (BITS_PER_LONG == 32)
diff --git a/fs/xfs/xfs_utils.c b/fs/xfs/xfs_utils.c
index 816b945fa0ea..d1f8146a06ea 100644
--- a/fs/xfs/xfs_utils.c
+++ b/fs/xfs/xfs_utils.c
@@ -147,7 +147,7 @@ xfs_dir_ialloc(
         xfs_inode_t     *dp,            /* directory within whose allocate
                                            the inode. */
         mode_t          mode,
-        nlink_t         nlink,
+        xfs_nlink_t     nlink,
         xfs_dev_t       rdev,
         cred_t          *credp,
         prid_t          prid,           /* project id */
diff --git a/fs/xfs/xfs_utils.h b/fs/xfs/xfs_utils.h
index e1ed6a588000..01d98b4b7af7 100644
--- a/fs/xfs/xfs_utils.h
+++ b/fs/xfs/xfs_utils.h
@@ -42,7 +42,7 @@ extern int xfs_get_dir_entry (vname_t *, xfs_inode_t **);
 extern int xfs_dir_lookup_int (bhv_desc_t *, uint, vname_t *, xfs_ino_t *,
                                 xfs_inode_t **);
 extern int xfs_truncate_file (xfs_mount_t *, xfs_inode_t *);
-extern int xfs_dir_ialloc (xfs_trans_t **, xfs_inode_t *, mode_t, nlink_t,
+extern int xfs_dir_ialloc (xfs_trans_t **, xfs_inode_t *, mode_t, xfs_nlink_t,
                                 xfs_dev_t, cred_t *, prid_t, int,
                                 xfs_inode_t **, int *);
 extern int xfs_droplink (xfs_trans_t *, xfs_inode_t *);
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index 00aae9c6a904..b53736650100 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -1649,6 +1649,7 @@ xfs_vget(
 #define MNTOPT_SWIDTH   "swidth"        /* data volume stripe width */
 #define MNTOPT_NOUUID   "nouuid"        /* ignore filesystem UUID */
 #define MNTOPT_MTPT     "mtpt"          /* filesystem mount point */
+#define MNTOPT_ALLOCSIZE    "allocsize"    /* preferred allocation size */
 #define MNTOPT_IHASHSIZE    "ihashsize"    /* size of inode hash table */
 #define MNTOPT_NORECOVERY   "norecovery"   /* don't run XFS recovery */
 #define MNTOPT_NOLOGFLUSH   "nologflush"   /* don't hard flush on log writes */
@@ -1657,6 +1658,28 @@ xfs_vget(
 #define MNTOPT_IKEEP    "ikeep"         /* do not free empty inode clusters */
 #define MNTOPT_NOIKEEP  "noikeep"       /* free empty inode clusters */
 
+STATIC unsigned long
+suffix_strtoul(const char *cp, char **endp, unsigned int base)
+{
+        int     last, shift_left_factor = 0;
+        char    *value = (char *)cp;
+
+        last = strlen(value) - 1;
+        if (value[last] == 'K' || value[last] == 'k') {
+                shift_left_factor = 10;
+                value[last] = '\0';
+        }
+        if (value[last] == 'M' || value[last] == 'm') {
+                shift_left_factor = 20;
+                value[last] = '\0';
+        }
+        if (value[last] == 'G' || value[last] == 'g') {
+                shift_left_factor = 30;
+                value[last] = '\0';
+        }
+
+        return simple_strtoul(cp, endp, base) << shift_left_factor;
+}
 
 int
 xfs_parseargs(
@@ -1688,60 +1711,60 @@ xfs_parseargs(
                 if (!strcmp(this_char, MNTOPT_LOGBUFS)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_LOGBUFS);
+                                        this_char);
                                 return EINVAL;
                         }
                         args->logbufs = simple_strtoul(value, &eov, 10);
                 } else if (!strcmp(this_char, MNTOPT_LOGBSIZE)) {
-                        int     last, in_kilobytes = 0;
-
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_LOGBSIZE);
+                                        this_char);
                                 return EINVAL;
                         }
-                        last = strlen(value) - 1;
-                        if (value[last] == 'K' || value[last] == 'k') {
-                                in_kilobytes = 1;
-                                value[last] = '\0';
-                        }
-                        args->logbufsize = simple_strtoul(value, &eov, 10);
-                        if (in_kilobytes)
-                                args->logbufsize <<= 10;
+                        args->logbufsize = suffix_strtoul(value, &eov, 10);
                 } else if (!strcmp(this_char, MNTOPT_LOGDEV)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_LOGDEV);
+                                        this_char);
                                 return EINVAL;
                         }
                         strncpy(args->logname, value, MAXNAMELEN);
                 } else if (!strcmp(this_char, MNTOPT_MTPT)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_MTPT);
+                                        this_char);
                                 return EINVAL;
                         }
                         strncpy(args->mtpt, value, MAXNAMELEN);
                 } else if (!strcmp(this_char, MNTOPT_RTDEV)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_RTDEV);
+                                        this_char);
                                 return EINVAL;
                         }
                         strncpy(args->rtname, value, MAXNAMELEN);
                 } else if (!strcmp(this_char, MNTOPT_BIOSIZE)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_BIOSIZE); 
+                                        this_char);
                                 return EINVAL;
                         }
                         iosize = simple_strtoul(value, &eov, 10);
                         args->flags |= XFSMNT_IOSIZE;
                         args->iosizelog = (uint8_t) iosize;
+                } else if (!strcmp(this_char, MNTOPT_ALLOCSIZE)) {
+                        if (!value || !*value) {
+                                printk("XFS: %s option requires an argument\n",
+                                        this_char);
+                                return EINVAL;
+                        }
+                        iosize = suffix_strtoul(value, &eov, 10);
+                        args->flags |= XFSMNT_IOSIZE;
+                        args->iosizelog = ffs(iosize) - 1;
                 } else if (!strcmp(this_char, MNTOPT_IHASHSIZE)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        this_char); 
+                                        this_char);
                                 return EINVAL;
                         }
                         args->flags |= XFSMNT_IHASHSIZE;
@@ -1756,7 +1779,7 @@ xfs_parseargs(
                         args->flags |= XFSMNT_INO64;
 #if !XFS_BIG_INUMS
                         printk("XFS: %s option not allowed on this system\n",
-                                MNTOPT_INO64);
+                                this_char);
                         return EINVAL;
 #endif
                 } else if (!strcmp(this_char, MNTOPT_NOALIGN)) {
@@ -1766,14 +1789,14 @@ xfs_parseargs(
                 } else if (!strcmp(this_char, MNTOPT_SUNIT)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_SUNIT);
+                                        this_char);
                                 return EINVAL;
                         }
                         dsunit = simple_strtoul(value, &eov, 10);
                 } else if (!strcmp(this_char, MNTOPT_SWIDTH)) {
                         if (!value || !*value) {
                                 printk("XFS: %s option requires an argument\n",
-                                        MNTOPT_SWIDTH);
+                                        this_char);
                                 return EINVAL;
                         }
                         dswidth = simple_strtoul(value, &eov, 10);
@@ -1781,7 +1804,7 @@ xfs_parseargs(
                         args->flags &= ~XFSMNT_32BITINODES;
 #if !XFS_BIG_INUMS
                         printk("XFS: %s option not allowed on this system\n",
-                                MNTOPT_64BITINODE);
+                                this_char);
                         return EINVAL;
 #endif
                 } else if (!strcmp(this_char, MNTOPT_NOUUID)) {
@@ -1877,7 +1900,7 @@ xfs_showargs(
                 seq_printf(m, "," MNTOPT_IHASHSIZE "=%d", mp->m_ihsize);
 
         if (mp->m_flags & XFS_MOUNT_DFLT_IOSIZE)
-                seq_printf(m, "," MNTOPT_BIOSIZE "=%d", mp->m_writeio_log);
+                seq_printf(m, "," MNTOPT_ALLOCSIZE "=%d", 1<<mp->m_writeio_log);
 
         if (mp->m_logbufs > 0)
                 seq_printf(m, "," MNTOPT_LOGBUFS "=%d", mp->m_logbufs);
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 70092963ca9e..25a526629b12 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -305,7 +305,7 @@ xfs_setattr(
         int                     mandlock_before, mandlock_after;
         struct xfs_dquot        *udqp, *gdqp, *olddquot1, *olddquot2;
         int                     file_owner;
-        int                     need_iolock = (flags & ATTR_DMI) == 0;
+        int                     need_iolock = 1;
 
         vp = BHV_TO_VNODE(bdp);
         vn_trace_entry(vp, __FUNCTION__, (inst_t *)__return_address);
@@ -384,6 +384,9 @@ xfs_setattr(
          */
         tp = NULL;
         lock_flags = XFS_ILOCK_EXCL;
+        ASSERT(flags & ATTR_NOLOCK ? flags & ATTR_DMI : 1);
+        if (flags & ATTR_NOLOCK)
+                need_iolock = 0;
         if (!(mask & XFS_AT_SIZE)) {
                 if ((mask != (XFS_AT_CTIME|XFS_AT_ATIME|XFS_AT_MTIME)) ||
                     (mp->m_flags & XFS_MOUNT_WSYNC)) {
@@ -4320,7 +4323,7 @@ xfs_free_file_space(
         int                     rt;
         xfs_fileoff_t           startoffset_fsb;
         xfs_trans_t             *tp;
-        int                     need_iolock = (attr_flags & ATTR_DMI) == 0;
+        int                     need_iolock = 1;
 
         vn_trace_entry(XFS_ITOV(ip), __FUNCTION__, (inst_t *)__return_address);
         mp = ip->i_mount;
@@ -4348,8 +4351,12 @@ xfs_free_file_space(
                         return(error);
         }
 
+        ASSERT(attr_flags & ATTR_NOLOCK ? attr_flags & ATTR_DMI : 1);
+        if (attr_flags & ATTR_NOLOCK)
+                need_iolock = 0;
         if (need_iolock)
                 xfs_ilock(ip, XFS_IOLOCK_EXCL);
+
         rounding = MAX((__uint8_t)(1 << mp->m_sb.sb_blocklog),
                         (__uint8_t)NBPP);
         ilen = len + (offset & (rounding - 1));
diff --git a/include/asm-arm/arch-imx/imx-regs.h b/include/asm-arm/arch-imx/imx-regs.h
index f32c203952cf..93b840e8fa60 100644
--- a/include/asm-arm/arch-imx/imx-regs.h
+++ b/include/asm-arm/arch-imx/imx-regs.h
@@ -228,6 +228,30 @@
 #define PD31_BIN_SPI2_TXD    ( GPIO_PORTD | GPIO_BIN | 31 )
 
 /*
+ * PWM controller
+ */
+#define PWMC    __REG(IMX_PWM_BASE + 0x00)      /* PWM Control Register         */
+#define PWMS    __REG(IMX_PWM_BASE + 0x04)      /* PWM Sample Register          */
+#define PWMP    __REG(IMX_PWM_BASE + 0x08)      /* PWM Period Register          */
+#define PWMCNT  __REG(IMX_PWM_BASE + 0x0C)      /* PWM Counter Register         */
+
+#define PWMC_HCTR               (0x01<<18)              /* Halfword FIFO Data Swapping  */
+#define PWMC_BCTR               (0x01<<17)              /* Byte FIFO Data Swapping      */
+#define PWMC_SWR                (0x01<<16)              /* Software Reset               */
+#define PWMC_CLKSRC             (0x01<<15)              /* Clock Source                 */
+#define PWMC_PRESCALER(x)       (((x-1) & 0x7F) << 8)   /* PRESCALER                    */
+#define PWMC_IRQ                (0x01<< 7)              /* Interrupt Request            */
+#define PWMC_IRQEN              (0x01<< 6)              /* Interrupt Request Enable     */
+#define PWMC_FIFOAV             (0x01<< 5)              /* FIFO Available               */
+#define PWMC_EN                 (0x01<< 4)              /* Enables/Disables the PWM     */
+#define PWMC_REPEAT(x)          (((x) & 0x03) << 2)     /* Sample Repeats               */
+#define PWMC_CLKSEL(x)          (((x) & 0x03) << 0)     /* Clock Selection              */
+
+#define PWMS_SAMPLE(x)          ((x) & 0xFFFF)          /* Contains a two-sample word   */
+#define PWMP_PERIOD(x)          ((x) & 0xFFFF)          /* Represents the PWM's period  */
+#define PWMC_COUNTER(x)         ((x) & 0xFFFF)          /* Represents the current count value   */
+
+/*
  *  DMA Controller
  */
 #define DCR     __REG(IMX_DMAC_BASE +0x00)      /* DMA Control Register */
diff --git a/include/asm-arm/arch-imx/imxfb.h b/include/asm-arm/arch-imx/imxfb.h
new file mode 100644
index 000000000000..2346d454ab9c
--- /dev/null
+++ b/include/asm-arm/arch-imx/imxfb.h
@@ -0,0 +1,35 @@
+/*
+ * This structure describes the machine which we are running on.
+ */
+struct imxfb_mach_info {
+        u_long          pixclock;
+
+        u_short         xres;
+        u_short         yres;
+
+        u_char          bpp;
+        u_char          hsync_len;
+        u_char          left_margin;
+        u_char          right_margin;
+
+        u_char          vsync_len;
+        u_char          upper_margin;
+        u_char          lower_margin;
+        u_char          sync;
+
+        u_int           cmap_greyscale:1,
+                        cmap_inverse:1,
+                        cmap_static:1,
+                        unused:29;
+
+        u_int           pcr;
+        u_int           pwmr;
+        u_int           lscr1;
+
+        u_char * fixed_screen_cpu;
+        dma_addr_t fixed_screen_dma;
+
+        void (*lcd_power)(int);
+        void (*backlight_power)(int);
+};
+void set_imx_fb_info(struct imxfb_mach_info *hard_imx_fb_info);
diff --git a/include/asm-arm/arch-s3c2410/regs-nand.h b/include/asm-arm/arch-s3c2410/regs-nand.h
index c443ac834698..7cff235e667a 100644
--- a/include/asm-arm/arch-s3c2410/regs-nand.h
+++ b/include/asm-arm/arch-s3c2410/regs-nand.h
@@ -1,16 +1,17 @@
 /* linux/include/asm-arm/arch-s3c2410/regs-nand.h
  *
- * Copyright (c) 2004 Simtec Electronics <linux@simtec.co.uk>
+ * Copyright (c) 2004,2005 Simtec Electronics <linux@simtec.co.uk>
  *                    http://www.simtec.co.uk/products/SWLINUX/
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
- * S3C2410 clock register definitions
+ * S3C2410 NAND register definitions
  *
  *  Changelog:
  *    18-Aug-2004    BJD     Copied file from 2.4 and updated
+ *    01-May-2005    BJD     Added definitions for s3c2440 controller
 */
 
 #ifndef __ASM_ARM_REGS_NAND
@@ -26,6 +27,22 @@
 #define S3C2410_NFSTAT  S3C2410_NFREG(0x10)
 #define S3C2410_NFECC   S3C2410_NFREG(0x14)
 
+#define S3C2440_NFCONT   S3C2410_NFREG(0x04)
+#define S3C2440_NFCMD    S3C2410_NFREG(0x08)
+#define S3C2440_NFADDR   S3C2410_NFREG(0x0C)
+#define S3C2440_NFDATA   S3C2410_NFREG(0x10)
+#define S3C2440_NFECCD0  S3C2410_NFREG(0x14)
+#define S3C2440_NFECCD1  S3C2410_NFREG(0x18)
+#define S3C2440_NFECCD   S3C2410_NFREG(0x1C)
+#define S3C2440_NFSTAT   S3C2410_NFREG(0x20)
+#define S3C2440_NFESTAT0 S3C2410_NFREG(0x24)
+#define S3C2440_NFESTAT1 S3C2410_NFREG(0x28)
+#define S3C2440_NFMECC0  S3C2410_NFREG(0x2C)
+#define S3C2440_NFMECC1  S3C2410_NFREG(0x30)
+#define S3C2440_NFSECC   S3C2410_NFREG(0x34)
+#define S3C2440_NFSBLK   S3C2410_NFREG(0x38)
+#define S3C2440_NFEBLK   S3C2410_NFREG(0x3C)
+
 #define S3C2410_NFCONF_EN          (1<<15)
 #define S3C2410_NFCONF_512BYTE     (1<<14)
 #define S3C2410_NFCONF_4STEP       (1<<13)
@@ -37,7 +54,28 @@
 
 #define S3C2410_NFSTAT_BUSY        (1<<0)
 
-/* think ECC can only be 8bit read? */
+#define S3C2440_NFCONF_BUSWIDTH_8       (0<<0)
+#define S3C2440_NFCONF_BUSWIDTH_16      (1<<0)
+#define S3C2440_NFCONF_ADVFLASH         (1<<3)
+#define S3C2440_NFCONF_TACLS(x)         ((x)<<12)
+#define S3C2440_NFCONF_TWRPH0(x)        ((x)<<8)
+#define S3C2440_NFCONF_TWRPH1(x)        ((x)<<4)
+
+#define S3C2440_NFCONT_LOCKTIGHT        (1<<13)
+#define S3C2440_NFCONT_SOFTLOCK         (1<<12)
+#define S3C2440_NFCONT_ILLEGALACC_EN    (1<<10)
+#define S3C2440_NFCONT_RNBINT_EN        (1<<9)
+#define S3C2440_NFCONT_RN_FALLING       (1<<8)
+#define S3C2440_NFCONT_SPARE_ECCLOCK    (1<<6)
+#define S3C2440_NFCONT_MAIN_ECCLOCK     (1<<5)
+#define S3C2440_NFCONT_INITECC          (1<<4)
+#define S3C2440_NFCONT_nFCE             (1<<1)
+#define S3C2440_NFCONT_ENABLE           (1<<0)
+
+#define S3C2440_NFSTAT_READY            (1<<0)
+#define S3C2440_NFSTAT_nCE              (1<<1)
+#define S3C2440_NFSTAT_RnB_CHANGE       (1<<2)
+#define S3C2440_NFSTAT_ILLEGAL_ACCESS   (1<<3)
 
 #endif /* __ASM_ARM_REGS_NAND */
 
diff --git a/include/asm-arm/page.h b/include/asm-arm/page.h
index 4ca3a8e9348f..019c45d75730 100644
--- a/include/asm-arm/page.h
+++ b/include/asm-arm/page.h
@@ -114,19 +114,8 @@ extern void __cpu_copy_user_page(void *to, const void *from,
                                  unsigned long user);
 #endif
 
-#define clear_user_page(addr,vaddr,pg)                  \
-        do {                                            \
-                preempt_disable();                      \
-                __cpu_clear_user_page(addr, vaddr);     \
-                preempt_enable();                       \
-        } while (0)
-
-#define copy_user_page(to,from,vaddr,pg)                \
-        do {                                            \
-                preempt_disable();                      \
-                __cpu_copy_user_page(to, from, vaddr);  \
-                preempt_enable();                       \
-        } while (0)
+#define clear_user_page(addr,vaddr,pg)   __cpu_clear_user_page(addr, vaddr)
+#define copy_user_page(to,from,vaddr,pg) __cpu_copy_user_page(to, from, vaddr)
 
 #define clear_page(page)        memzero((void *)(page), PAGE_SIZE)
 extern void copy_page(void *to, const void *from);
@@ -171,6 +160,9 @@ typedef unsigned long pgprot_t;
 
 #endif /* STRICT_MM_TYPECHECKS */
 
+/* the upper-most page table pointer */
+extern pmd_t *top_pmd;
+
 /* Pure 2^n version of get_order */
 static inline int get_order(unsigned long size)
 {
diff --git a/include/asm-arm/processor.h b/include/asm-arm/processor.h
index 4a9845997a75..7d4118e09054 100644
--- a/include/asm-arm/processor.h
+++ b/include/asm-arm/processor.h
@@ -23,8 +23,6 @@
 #include <asm/procinfo.h>
 #include <asm/types.h>
 
-#define KERNEL_STACK_SIZE       PAGE_SIZE
-
 union debug_insn {
         u32     arm;
         u16     thumb;
@@ -87,8 +85,9 @@ unsigned long get_wchan(struct task_struct *p);
  */
 extern int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
 
-#define KSTK_EIP(tsk)   (((unsigned long *)(4096+(unsigned long)(tsk)->thread_info))[1019])
-#define KSTK_ESP(tsk)   (((unsigned long *)(4096+(unsigned long)(tsk)->thread_info))[1017])
+#define KSTK_REGS(tsk)  (((struct pt_regs *)(THREAD_START_SP + (unsigned long)(tsk)->thread_info)) - 1)
+#define KSTK_EIP(tsk)   KSTK_REGS(tsk)->ARM_pc
+#define KSTK_ESP(tsk)   KSTK_REGS(tsk)->ARM_sp
 
 /*
  * Prefetching support - only ARMv5.
diff --git a/include/asm-arm/thread_info.h b/include/asm-arm/thread_info.h
index a61618fb433c..66c585c50cf9 100644
--- a/include/asm-arm/thread_info.h
+++ b/include/asm-arm/thread_info.h
@@ -14,6 +14,10 @@
 
 #include <asm/fpstate.h>
 
+#define THREAD_SIZE_ORDER       1
+#define THREAD_SIZE             8192
+#define THREAD_START_SP         (THREAD_SIZE - 8)
+
 #ifndef __ASSEMBLY__
 
 struct task_struct;
@@ -77,8 +81,6 @@ struct thread_info {
 #define init_thread_info        (init_thread_union.thread_info)
 #define init_stack              (init_thread_union.stack)
 
-#define THREAD_SIZE             8192
-
 /*
  * how to get the thread information struct from C
  */
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 976ac29598b7..195ccdc069e6 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -8,6 +8,8 @@ extern char _data[], _sdata[], _edata[];
 extern char __bss_start[], __bss_stop[];
 extern char __init_begin[], __init_end[];
 extern char _sinittext[], _einittext[];
+extern char _sextratext[] __attribute__((weak));
+extern char _eextratext[] __attribute__((weak));
 extern char _end[];
 
 #endif /* _ASM_GENERIC_SECTIONS_H_ */
diff --git a/include/asm-i386/floppy.h b/include/asm-i386/floppy.h
index f4782284807a..79727afb94c9 100644
--- a/include/asm-i386/floppy.h
+++ b/include/asm-i386/floppy.h
@@ -257,7 +257,7 @@ static int hard_dma_setup(char *addr, unsigned long size, int mode, int io)
         return 0;
 }
 
-struct fd_routine_l {
+static struct fd_routine_l {
         int (*_request_dma)(unsigned int dmanr, const char * device_id);
         void (*_free_dma)(unsigned int dmanr);
         int (*_get_dma_residue)(unsigned int dummy);
diff --git a/include/asm-i386/module.h b/include/asm-i386/module.h
index 508865e26308..eb7f2b4234aa 100644
--- a/include/asm-i386/module.h
+++ b/include/asm-i386/module.h
@@ -52,8 +52,8 @@ struct mod_arch_specific
 #define MODULE_PROC_FAMILY "CYRIXIII "
 #elif defined CONFIG_MVIAC3_2
 #define MODULE_PROC_FAMILY "VIAC3-2 "
-#elif CONFIG_MGEODE
-#define MODULE_PROC_FAMILY "GEODE "
+#elif CONFIG_MGEODEGX1
+#define MODULE_PROC_FAMILY "GEODEGX1 "
 #else
 #error unknown processor family
 #endif
diff --git a/include/asm-ia64/ioctl32.h b/include/asm-ia64/ioctl32.h
deleted file mode 100644
index d0d227f45e05..000000000000
--- a/include/asm-ia64/ioctl32.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <linux/ioctl32.h>
diff --git a/include/asm-parisc/floppy.h b/include/asm-parisc/floppy.h
index 47f53df2cef5..ca3aed768cdc 100644
--- a/include/asm-parisc/floppy.h
+++ b/include/asm-parisc/floppy.h
@@ -235,7 +235,7 @@ static int hard_dma_setup(char *addr, unsigned long size, int mode, int io)
         return 0;
 }
 
-struct fd_routine_l {
+static struct fd_routine_l {
         int (*_request_dma)(unsigned int dmanr, const char * device_id);
         void (*_free_dma)(unsigned int dmanr);
         int (*_get_dma_residue)(unsigned int dummy);
diff --git a/include/asm-ppc64/imalloc.h b/include/asm-ppc64/imalloc.h
new file mode 100644
index 000000000000..3a45e918bf16
--- /dev/null
+++ b/include/asm-ppc64/imalloc.h
@@ -0,0 +1,24 @@
+#ifndef _PPC64_IMALLOC_H
+#define _PPC64_IMALLOC_H
+
+/*
+ * Define the address range of the imalloc VM area.
+ */
+#define PHBS_IO_BASE      IOREGIONBASE
+#define IMALLOC_BASE      (IOREGIONBASE + 0x80000000ul) /* Reserve 2 gigs for PHBs */
+#define IMALLOC_END       (IOREGIONBASE + EADDR_MASK)
+
+
+/* imalloc region types */
+#define IM_REGION_UNUSED        0x1
+#define IM_REGION_SUBSET        0x2
+#define IM_REGION_EXISTS        0x4
+#define IM_REGION_OVERLAP       0x8
+#define IM_REGION_SUPERSET      0x10
+
+extern struct vm_struct * im_get_free_area(unsigned long size);
+extern struct vm_struct * im_get_area(unsigned long v_addr, unsigned long size,
+                        int region_type);
+unsigned long im_free(void *addr);
+
+#endif /* _PPC64_IMALLOC_H */
diff --git a/include/asm-ppc64/mmu.h b/include/asm-ppc64/mmu.h
index 188987e9d9d4..c78282a67d8e 100644
--- a/include/asm-ppc64/mmu.h
+++ b/include/asm-ppc64/mmu.h
@@ -15,19 +15,10 @@
 
 #include <linux/config.h>
 #include <asm/page.h>
-#include <linux/stringify.h>
 
-#ifndef __ASSEMBLY__
-
-/* Time to allow for more things here */
-typedef unsigned long mm_context_id_t;
-typedef struct {
-        mm_context_id_t id;
-#ifdef CONFIG_HUGETLB_PAGE
-        pgd_t *huge_pgdir;
-        u16 htlb_segs; /* bitmask */
-#endif
-} mm_context_t;
+/*
+ * Segment table
+ */
 
 #define STE_ESID_V      0x80
 #define STE_ESID_KS     0x20
@@ -36,15 +27,48 @@ typedef struct {
 
 #define STE_VSID_SHIFT  12
 
-struct stab_entry {
-        unsigned long esid_data;
-        unsigned long vsid_data;
-};
+/* Location of cpu0's segment table */
+#define STAB0_PAGE      0x9
+#define STAB0_PHYS_ADDR (STAB0_PAGE<<PAGE_SHIFT)
+#define STAB0_VIRT_ADDR (KERNELBASE+STAB0_PHYS_ADDR)
+
+/*
+ * SLB
+ */
 
-/* Hardware Page Table Entry */
+#define SLB_NUM_BOLTED          3
+#define SLB_CACHE_ENTRIES       8
+
+/* Bits in the SLB ESID word */
+#define SLB_ESID_V              ASM_CONST(0x0000000008000000) /* valid */
+
+/* Bits in the SLB VSID word */
+#define SLB_VSID_SHIFT          12
+#define SLB_VSID_KS             ASM_CONST(0x0000000000000800)
+#define SLB_VSID_KP             ASM_CONST(0x0000000000000400)
+#define SLB_VSID_N              ASM_CONST(0x0000000000000200) /* no-execute */
+#define SLB_VSID_L              ASM_CONST(0x0000000000000100) /* largepage 16M */
+#define SLB_VSID_C              ASM_CONST(0x0000000000000080) /* class */
+
+#define SLB_VSID_KERNEL         (SLB_VSID_KP|SLB_VSID_C)
+#define SLB_VSID_USER           (SLB_VSID_KP|SLB_VSID_KS)
+
+/*
+ * Hash table
+ */
 
 #define HPTES_PER_GROUP 8
 
+/* Values for PP (assumes Ks=0, Kp=1) */
+/* pp0 will always be 0 for linux     */
+#define PP_RWXX 0       /* Supervisor read/write, User none */
+#define PP_RWRX 1       /* Supervisor read/write, User read */
+#define PP_RWRW 2       /* Supervisor read/write, User read/write */
+#define PP_RXRX 3       /* Supervisor read,       User read */
+
+#ifndef __ASSEMBLY__
+
+/* Hardware Page Table Entry */
 typedef struct {
         unsigned long avpn:57; /* vsid | api == avpn  */
         unsigned long :     2; /* Software use */
@@ -90,14 +114,6 @@ typedef struct {
         } dw1;
 } HPTE; 
 
-/* Values for PP (assumes Ks=0, Kp=1) */
-/* pp0 will always be 0 for linux     */
-#define PP_RWXX 0       /* Supervisor read/write, User none */
-#define PP_RWRX 1       /* Supervisor read/write, User read */
-#define PP_RWRW 2       /* Supervisor read/write, User read/write */
-#define PP_RXRX 3       /* Supervisor read,       User read */
-
-
 extern HPTE *           htab_address;
 extern unsigned long    htab_hash_mask;
 
@@ -174,31 +190,70 @@ extern int __hash_page(unsigned long ea, unsigned long access,
 
 extern void htab_finish_init(void);
 
+extern void hpte_init_native(void);
+extern void hpte_init_lpar(void);
+extern void hpte_init_iSeries(void);
+
+extern long pSeries_lpar_hpte_insert(unsigned long hpte_group,
+                                     unsigned long va, unsigned long prpn,
+                                     int secondary, unsigned long hpteflags,
+                                     int bolted, int large);
+extern long native_hpte_insert(unsigned long hpte_group, unsigned long va,
+                               unsigned long prpn, int secondary,
+                               unsigned long hpteflags, int bolted, int large);
+
 #endif /* __ASSEMBLY__ */
 
 /*
- * Location of cpu0's segment table
+ * VSID allocation
+ *
+ * We first generate a 36-bit "proto-VSID".  For kernel addresses this
+ * is equal to the ESID, for user addresses it is:
+ *      (context << 15) | (esid & 0x7fff)
+ *
+ * The two forms are distinguishable because the top bit is 0 for user
+ * addresses, whereas the top two bits are 1 for kernel addresses.
+ * Proto-VSIDs with the top two bits equal to 0b10 are reserved for
+ * now.
+ *
+ * The proto-VSIDs are then scrambled into real VSIDs with the
+ * multiplicative hash:
+ *
+ *      VSID = (proto-VSID * VSID_MULTIPLIER) % VSID_MODULUS
+ *      where   VSID_MULTIPLIER = 268435399 = 0xFFFFFC7
+ *              VSID_MODULUS = 2^36-1 = 0xFFFFFFFFF
+ *
+ * This scramble is only well defined for proto-VSIDs below
+ * 0xFFFFFFFFF, so both proto-VSID and actual VSID 0xFFFFFFFFF are
+ * reserved.  VSID_MULTIPLIER is prime, so in particular it is
+ * co-prime to VSID_MODULUS, making this a 1:1 scrambling function.
+ * Because the modulus is 2^n-1 we can compute it efficiently without
+ * a divide or extra multiply (see below).
+ *
+ * This scheme has several advantages over older methods:
+ *
+ *      - We have VSIDs allocated for every kernel address
+ * (i.e. everything above 0xC000000000000000), except the very top
+ * segment, which simplifies several things.
+ *
+ *      - We allow for 15 significant bits of ESID and 20 bits of
+ * context for user addresses.  i.e. 8T (43 bits) of address space for
+ * up to 1M contexts (although the page table structure and context
+ * allocation will need changes to take advantage of this).
+ *
+ *      - The scramble function gives robust scattering in the hash
+ * table (at least based on some initial results).  The previous
+ * method was more susceptible to pathological cases giving excessive
+ * hash collisions.
+ */
+/*
+ * WARNING - If you change these you must make sure the asm
+ * implementations in slb_allocate (slb_low.S), do_stab_bolted
+ * (head.S) and ASM_VSID_SCRAMBLE (below) are changed accordingly.
+ *
+ * You'll also need to change the precomputed VSID values in head.S
+ * which are used by the iSeries firmware.
  */
-#define STAB0_PAGE      0x9
-#define STAB0_PHYS_ADDR (STAB0_PAGE<<PAGE_SHIFT)
-#define STAB0_VIRT_ADDR (KERNELBASE+STAB0_PHYS_ADDR)
-
-#define SLB_NUM_BOLTED          3
-#define SLB_CACHE_ENTRIES       8
-
-/* Bits in the SLB ESID word */
-#define SLB_ESID_V              0x0000000008000000      /* entry is valid */
-
-/* Bits in the SLB VSID word */
-#define SLB_VSID_SHIFT          12
-#define SLB_VSID_KS             0x0000000000000800
-#define SLB_VSID_KP             0x0000000000000400
-#define SLB_VSID_N              0x0000000000000200      /* no-execute */
-#define SLB_VSID_L              0x0000000000000100      /* largepage (4M) */
-#define SLB_VSID_C              0x0000000000000080      /* class */
-
-#define SLB_VSID_KERNEL         (SLB_VSID_KP|SLB_VSID_C)
-#define SLB_VSID_USER           (SLB_VSID_KP|SLB_VSID_KS)
 
 #define VSID_MULTIPLIER ASM_CONST(200730139)    /* 28-bit prime */
 #define VSID_BITS       36
@@ -239,4 +294,50 @@ extern void htab_finish_init(void);
         srdi    rx,rx,VSID_BITS;        /* extract 2^36 bit */          \
         add     rt,rt,rx
 
+
+#ifndef __ASSEMBLY__
+
+typedef unsigned long mm_context_id_t;
+
+typedef struct {
+        mm_context_id_t id;
+#ifdef CONFIG_HUGETLB_PAGE
+        pgd_t *huge_pgdir;
+        u16 htlb_segs; /* bitmask */
+#endif
+} mm_context_t;
+
+
+static inline unsigned long vsid_scramble(unsigned long protovsid)
+{
+#if 0
+        /* The code below is equivalent to this function for arguments
+         * < 2^VSID_BITS, which is all this should ever be called
+         * with.  However gcc is not clever enough to compute the
+         * modulus (2^n-1) without a second multiply. */
+        return ((protovsid * VSID_MULTIPLIER) % VSID_MODULUS);
+#else /* 1 */
+        unsigned long x;
+
+        x = protovsid * VSID_MULTIPLIER;
+        x = (x >> VSID_BITS) + (x & VSID_MODULUS);
+        return (x + ((x+1) >> VSID_BITS)) & VSID_MODULUS;
+#endif /* 1 */
+}
+
+/* This is only valid for addresses >= KERNELBASE */
+static inline unsigned long get_kernel_vsid(unsigned long ea)
+{
+        return vsid_scramble(ea >> SID_SHIFT);
+}
+
+/* This is only valid for user addresses (which are below 2^41) */
+static inline unsigned long get_vsid(unsigned long context, unsigned long ea)
+{
+        return vsid_scramble((context << USER_ESID_BITS)
+                             | (ea >> SID_SHIFT));
+}
+
+#endif /* __ASSEMBLY */
+
 #endif /* _PPC64_MMU_H_ */
diff --git a/include/asm-ppc64/mmu_context.h b/include/asm-ppc64/mmu_context.h
index c2e8e0466383..77a743402db4 100644
--- a/include/asm-ppc64/mmu_context.h
+++ b/include/asm-ppc64/mmu_context.h
@@ -84,86 +84,4 @@ static inline void activate_mm(struct mm_struct *prev, struct mm_struct *next)
         local_irq_restore(flags);
 }
 
-/* VSID allocation
- * ===============
- *
- * We first generate a 36-bit "proto-VSID".  For kernel addresses this
- * is equal to the ESID, for user addresses it is:
- *      (context << 15) | (esid & 0x7fff)
- *
- * The two forms are distinguishable because the top bit is 0 for user
- * addresses, whereas the top two bits are 1 for kernel addresses.
- * Proto-VSIDs with the top two bits equal to 0b10 are reserved for
- * now.
- *
- * The proto-VSIDs are then scrambled into real VSIDs with the
- * multiplicative hash:
- *
- *      VSID = (proto-VSID * VSID_MULTIPLIER) % VSID_MODULUS
- *      where   VSID_MULTIPLIER = 268435399 = 0xFFFFFC7
- *              VSID_MODULUS = 2^36-1 = 0xFFFFFFFFF
- *
- * This scramble is only well defined for proto-VSIDs below
- * 0xFFFFFFFFF, so both proto-VSID and actual VSID 0xFFFFFFFFF are
- * reserved.  VSID_MULTIPLIER is prime, so in particular it is
- * co-prime to VSID_MODULUS, making this a 1:1 scrambling function.
- * Because the modulus is 2^n-1 we can compute it efficiently without
- * a divide or extra multiply (see below).
- *
- * This scheme has several advantages over older methods:
- *
- *      - We have VSIDs allocated for every kernel address
- * (i.e. everything above 0xC000000000000000), except the very top
- * segment, which simplifies several things.
- *
- *      - We allow for 15 significant bits of ESID and 20 bits of
- * context for user addresses.  i.e. 8T (43 bits) of address space for
- * up to 1M contexts (although the page table structure and context
- * allocation will need changes to take advantage of this).
- *
- *      - The scramble function gives robust scattering in the hash
- * table (at least based on some initial results).  The previous
- * method was more susceptible to pathological cases giving excessive
- * hash collisions.
- */
-
-/*
- * WARNING - If you change these you must make sure the asm
- * implementations in slb_allocate(), do_stab_bolted and mmu.h
- * (ASM_VSID_SCRAMBLE macro) are changed accordingly.
- *
- * You'll also need to change the precomputed VSID values in head.S
- * which are used by the iSeries firmware.
- */
-
-static inline unsigned long vsid_scramble(unsigned long protovsid)
-{
-#if 0
-        /* The code below is equivalent to this function for arguments
-         * < 2^VSID_BITS, which is all this should ever be called
-         * with.  However gcc is not clever enough to compute the
-         * modulus (2^n-1) without a second multiply. */
-        return ((protovsid * VSID_MULTIPLIER) % VSID_MODULUS);
-#else /* 1 */
-        unsigned long x;
-
-        x = protovsid * VSID_MULTIPLIER;
-        x = (x >> VSID_BITS) + (x & VSID_MODULUS);
-        return (x + ((x+1) >> VSID_BITS)) & VSID_MODULUS;
-#endif /* 1 */
-}
-
-/* This is only valid for addresses >= KERNELBASE */
-static inline unsigned long get_kernel_vsid(unsigned long ea)
-{
-        return vsid_scramble(ea >> SID_SHIFT);
-}
-
-/* This is only valid for user addresses (which are below 2^41) */
-static inline unsigned long get_vsid(unsigned long context, unsigned long ea)
-{
-        return vsid_scramble((context << USER_ESID_BITS)
-                             | (ea >> SID_SHIFT));
-}
-
 #endif /* __PPC64_MMU_CONTEXT_H */
diff --git a/include/asm-ppc64/page.h b/include/asm-ppc64/page.h
index 86219574c1a5..bcd21789d3b7 100644
--- a/include/asm-ppc64/page.h
+++ b/include/asm-ppc64/page.h
@@ -23,7 +23,6 @@
 #define PAGE_SHIFT      12
 #define PAGE_SIZE       (ASM_CONST(1) << PAGE_SHIFT)
 #define PAGE_MASK       (~(PAGE_SIZE-1))
-#define PAGE_OFFSET_MASK (PAGE_SIZE-1)
 
 #define SID_SHIFT       28
 #define SID_MASK        0xfffffffffUL
@@ -85,9 +84,6 @@
 /* align addr on a size boundary - adjust address up if needed */
 #define _ALIGN(addr,size)     _ALIGN_UP(addr,size)
 
-/* to align the pointer to the (next) double word boundary */
-#define DOUBLEWORD_ALIGN(addr)  _ALIGN(addr,sizeof(unsigned long))
-
 /* to align the pointer to the (next) page boundary */
 #define PAGE_ALIGN(addr)        _ALIGN(addr, PAGE_SIZE)
 
@@ -100,7 +96,6 @@
 #define REGION_SIZE   4UL
 #define REGION_SHIFT  60UL
 #define REGION_MASK   (((1UL<<REGION_SIZE)-1UL)<<REGION_SHIFT)
-#define REGION_STRIDE (1UL << REGION_SHIFT)
 
 static __inline__ void clear_page(void *addr)
 {
@@ -209,13 +204,13 @@ extern u64 ppc64_pft_size;		/* Log 2 of page table size */
 #define VMALLOCBASE     ASM_CONST(0xD000000000000000)
 #define IOREGIONBASE    ASM_CONST(0xE000000000000000)
 
-#define IO_REGION_ID       (IOREGIONBASE>>REGION_SHIFT)
-#define VMALLOC_REGION_ID  (VMALLOCBASE>>REGION_SHIFT)
-#define KERNEL_REGION_ID   (KERNELBASE>>REGION_SHIFT)
+#define IO_REGION_ID       (IOREGIONBASE >> REGION_SHIFT)
+#define VMALLOC_REGION_ID  (VMALLOCBASE >> REGION_SHIFT)
+#define KERNEL_REGION_ID   (KERNELBASE >> REGION_SHIFT)
 #define USER_REGION_ID     (0UL)
-#define REGION_ID(X)       (((unsigned long)(X))>>REGION_SHIFT)
+#define REGION_ID(ea)      (((unsigned long)(ea)) >> REGION_SHIFT)
 
-#define __bpn_to_ba(x) ((((unsigned long)(x))<<PAGE_SHIFT) + KERNELBASE)
+#define __bpn_to_ba(x) ((((unsigned long)(x)) << PAGE_SHIFT) + KERNELBASE)
 #define __ba_to_bpn(x) ((((unsigned long)(x)) & ~REGION_MASK) >> PAGE_SHIFT)
 
 #define __va(x) ((void *)((unsigned long)(x) + KERNELBASE))
diff --git a/include/asm-ppc64/pgtable.h b/include/asm-ppc64/pgtable.h
index b984e2747e0c..264c4f7993be 100644
--- a/include/asm-ppc64/pgtable.h
+++ b/include/asm-ppc64/pgtable.h
@@ -17,16 +17,6 @@
 
 #include <asm-generic/pgtable-nopud.h>
 
-/* PMD_SHIFT determines what a second-level page table entry can map */
-#define PMD_SHIFT       (PAGE_SHIFT + PAGE_SHIFT - 3)
-#define PMD_SIZE        (1UL << PMD_SHIFT)
-#define PMD_MASK        (~(PMD_SIZE-1))
-
-/* PGDIR_SHIFT determines what a third-level page table entry can map */
-#define PGDIR_SHIFT     (PAGE_SHIFT + (PAGE_SHIFT - 3) + (PAGE_SHIFT - 2))
-#define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
-#define PGDIR_MASK      (~(PGDIR_SIZE-1))
-
 /*
  * Entries per page directory level.  The PTE level must use a 64b record
  * for each page table entry.  The PMD and PGD level use a 32b record for 
@@ -40,40 +30,30 @@
 #define PTRS_PER_PMD    (1 << PMD_INDEX_SIZE)
 #define PTRS_PER_PGD    (1 << PGD_INDEX_SIZE)
 
-#define USER_PTRS_PER_PGD       (1024)
-#define FIRST_USER_ADDRESS      0
+/* PMD_SHIFT determines what a second-level page table entry can map */
+#define PMD_SHIFT       (PAGE_SHIFT + PTE_INDEX_SIZE)
+#define PMD_SIZE        (1UL << PMD_SHIFT)
+#define PMD_MASK        (~(PMD_SIZE-1))
 
-#define EADDR_SIZE (PTE_INDEX_SIZE + PMD_INDEX_SIZE + \
-                    PGD_INDEX_SIZE + PAGE_SHIFT) 
+/* PGDIR_SHIFT determines what a third-level page table entry can map */
+#define PGDIR_SHIFT     (PMD_SHIFT + PMD_INDEX_SIZE)
+#define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
+#define PGDIR_MASK      (~(PGDIR_SIZE-1))
+
+#define FIRST_USER_ADDRESS      0
 
 /*
  * Size of EA range mapped by our pagetables.
  */
-#define PGTABLE_EA_BITS 41
-#define PGTABLE_EA_MASK ((1UL<<PGTABLE_EA_BITS)-1)
+#define EADDR_SIZE (PTE_INDEX_SIZE + PMD_INDEX_SIZE + \
+                    PGD_INDEX_SIZE + PAGE_SHIFT)
+#define EADDR_MASK ((1UL << EADDR_SIZE) - 1)
 
 /*
  * Define the address range of the vmalloc VM area.
  */
 #define VMALLOC_START (0xD000000000000000ul)
-#define VMALLOC_END   (VMALLOC_START + PGTABLE_EA_MASK)
-
-/*
- * Define the address range of the imalloc VM area.
- * (used for ioremap)
- */
-#define IMALLOC_START     (ioremap_bot)
-#define IMALLOC_VMADDR(x) ((unsigned long)(x))
-#define PHBS_IO_BASE      (0xE000000000000000ul)        /* Reserve 2 gigs for PHBs */
-#define IMALLOC_BASE      (0xE000000080000000ul)  
-#define IMALLOC_END       (IMALLOC_BASE + PGTABLE_EA_MASK)
-
-/*
- * Define the user address range
- */
-#define USER_START (0UL)
-#define USER_END   (USER_START + PGTABLE_EA_MASK)
-
+#define VMALLOC_END   (VMALLOC_START + EADDR_MASK)
 
 /*
  * Bits in a linux-style PTE.  These match the bits in the
@@ -168,10 +148,6 @@ extern unsigned long empty_zero_page[PAGE_SIZE/sizeof(unsigned long)];
 /* shift to put page number into pte */
 #define PTE_SHIFT (17)
 
-/* We allow 2^41 bytes of real memory, so we need 29 bits in the PMD
- * to give the PTE page number.  The bottom two bits are for flags. */
-#define PMD_TO_PTEPAGE_SHIFT (2)
-
 #ifdef CONFIG_HUGETLB_PAGE
 
 #ifndef __ASSEMBLY__
@@ -200,13 +176,14 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm);
  */
 #define mk_pte(page, pgprot)    pfn_pte(page_to_pfn(page), (pgprot))
 
-#define pfn_pte(pfn,pgprot)                                             \
-({                                                                      \
-        pte_t pte;                                                      \
-        pte_val(pte) = ((unsigned long)(pfn) << PTE_SHIFT) |            \
-                        pgprot_val(pgprot);                             \
-        pte;                                                            \
-})
+static inline pte_t pfn_pte(unsigned long pfn, pgprot_t pgprot)
+{
+        pte_t pte;
+
+
+        pte_val(pte) = (pfn << PTE_SHIFT) | pgprot_val(pgprot);
+        return pte;
+}
 
 #define pte_modify(_pte, newprot) \
   (__pte((pte_val(_pte) & _PAGE_CHG_MASK) | pgprot_val(newprot)))
@@ -220,13 +197,12 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm);
 #define pte_page(x)             pfn_to_page(pte_pfn(x))
 
 #define pmd_set(pmdp, ptep)     \
-        (pmd_val(*(pmdp)) = (__ba_to_bpn(ptep) << PMD_TO_PTEPAGE_SHIFT))
+        (pmd_val(*(pmdp)) = __ba_to_bpn(ptep))
 #define pmd_none(pmd)           (!pmd_val(pmd))
 #define pmd_bad(pmd)            (pmd_val(pmd) == 0)
 #define pmd_present(pmd)        (pmd_val(pmd) != 0)
 #define pmd_clear(pmdp)         (pmd_val(*(pmdp)) = 0)
-#define pmd_page_kernel(pmd)    \
-        (__bpn_to_ba(pmd_val(pmd) >> PMD_TO_PTEPAGE_SHIFT))
+#define pmd_page_kernel(pmd)    (__bpn_to_ba(pmd_val(pmd)))
 #define pmd_page(pmd)           virt_to_page(pmd_page_kernel(pmd))
 
 #define pud_set(pudp, pmdp)     (pud_val(*(pudp)) = (__ba_to_bpn(pmdp)))
@@ -266,8 +242,6 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm);
 /* to find an entry in the ioremap page-table-directory */
 #define pgd_offset_i(address) (ioremap_pgd + pgd_index(address))
 
-#define pages_to_mb(x)          ((x) >> (20-PAGE_SHIFT))
-
 /*
  * The following only work if pte_present() is true.
  * Undefined behaviour if not..
@@ -442,7 +416,7 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                 pte_clear(mm, addr, ptep);
                 flush_tlb_pending();
         }
-        *ptep = __pte(pte_val(pte)) & ~_PAGE_HPTEFLAGS;
+        *ptep = __pte(pte_val(pte) & ~_PAGE_HPTEFLAGS);
 }
 
 /* Set the dirty and/or accessed bits atomically in a linux PTE, this
@@ -487,18 +461,13 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long addr,
 
 extern unsigned long ioremap_bot, ioremap_base;
 
-#define USER_PGD_PTRS (PAGE_OFFSET >> PGDIR_SHIFT)
-#define KERNEL_PGD_PTRS (PTRS_PER_PGD-USER_PGD_PTRS)
-
-#define pte_ERROR(e) \
-        printk("%s:%d: bad pte %016lx.\n", __FILE__, __LINE__, pte_val(e))
 #define pmd_ERROR(e) \
         printk("%s:%d: bad pmd %08x.\n", __FILE__, __LINE__, pmd_val(e))
 #define pgd_ERROR(e) \
         printk("%s:%d: bad pgd %08x.\n", __FILE__, __LINE__, pgd_val(e))
 
-extern pgd_t swapper_pg_dir[1024];
-extern pgd_t ioremap_dir[1024];
+extern pgd_t swapper_pg_dir[];
+extern pgd_t ioremap_dir[];
 
 extern void paging_init(void);
 
@@ -540,43 +509,11 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t);
  */
 #define kern_addr_valid(addr)   (1)
 
-#define io_remap_page_range(vma, vaddr, paddr, size, prot)              \
-                remap_pfn_range(vma, vaddr, (paddr) >> PAGE_SHIFT, size, prot)
-
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
-#define MK_IOSPACE_PFN(space, pfn)      (pfn)
-#define GET_IOSPACE(pfn)                0
-#define GET_PFN(pfn)                    (pfn)
-
 void pgtable_cache_init(void);
 
-extern void hpte_init_native(void);
-extern void hpte_init_lpar(void);
-extern void hpte_init_iSeries(void);
-
-/* imalloc region types */
-#define IM_REGION_UNUSED        0x1
-#define IM_REGION_SUBSET        0x2
-#define IM_REGION_EXISTS        0x4
-#define IM_REGION_OVERLAP       0x8
-#define IM_REGION_SUPERSET      0x10
-
-extern struct vm_struct * im_get_free_area(unsigned long size);
-extern struct vm_struct * im_get_area(unsigned long v_addr, unsigned long size,
-                        int region_type);
-unsigned long im_free(void *addr);
-
-extern long pSeries_lpar_hpte_insert(unsigned long hpte_group,
-                                     unsigned long va, unsigned long prpn,
-                                     int secondary, unsigned long hpteflags,
-                                     int bolted, int large);
-
-extern long native_hpte_insert(unsigned long hpte_group, unsigned long va,
-                               unsigned long prpn, int secondary,
-                               unsigned long hpteflags, int bolted, int large);
-
 /*
  * find_linux_pte returns the address of a linux pte for a given 
  * effective address and directory.  If not found, it returns zero.
diff --git a/include/asm-ppc64/xics.h b/include/asm-ppc64/xics.h
index 0027da4364ac..fdec5e7a7af6 100644
--- a/include/asm-ppc64/xics.h
+++ b/include/asm-ppc64/xics.h
@@ -30,7 +30,4 @@ struct xics_ipi_struct {
 
 extern struct xics_ipi_struct xics_ipi_message[NR_CPUS] __cacheline_aligned;
 
-extern unsigned int default_distrib_server;
-extern unsigned int interrupt_server_size;
-
 #endif /* _PPC64_KERNEL_XICS_H */
diff --git a/include/asm-sh/floppy.h b/include/asm-sh/floppy.h
index f030ca08052b..38d7a2942476 100644
--- a/include/asm-sh/floppy.h
+++ b/include/asm-sh/floppy.h
@@ -227,7 +227,7 @@ static int hard_dma_setup(char *addr, unsigned long size, int mode, int io)
         return 0;
 }
 
-struct fd_routine_l {
+static struct fd_routine_l {
         int (*_request_dma)(unsigned int dmanr, const char * device_id);
         void (*_free_dma)(unsigned int dmanr);
         int (*_get_dma_residue)(unsigned int dummy);
diff --git a/include/asm-sparc64/pgalloc.h b/include/asm-sparc64/pgalloc.h
index 2c28e1f605b7..b9b1914aae63 100644
--- a/include/asm-sparc64/pgalloc.h
+++ b/include/asm-sparc64/pgalloc.h
@@ -122,17 +122,12 @@ static __inline__ void free_pmd_slow(pmd_t *pmd)
 #define pmd_populate(MM,PMD,PTE_PAGE)           \
         pmd_populate_kernel(MM,PMD,page_address(PTE_PAGE))
 
-extern pte_t *__pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address);
-
-static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address)
-{
-        return __pte_alloc_one_kernel(mm, address);
-}
+extern pte_t *pte_alloc_one_kernel(struct mm_struct *mm, unsigned long address);
 
 static inline struct page *
 pte_alloc_one(struct mm_struct *mm, unsigned long addr)
 {
-        pte_t *pte = __pte_alloc_one_kernel(mm, addr);
+        pte_t *pte = pte_alloc_one_kernel(mm, addr);
 
         if (pte)
                 return virt_to_page(pte);
diff --git a/include/asm-um/arch-signal-i386.h b/include/asm-um/arch-signal-i386.h
deleted file mode 100644
index 99a9de4728da..000000000000
--- a/include/asm-um/arch-signal-i386.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/* 
- * Copyright (C) 2002 Jeff Dike (jdike@karaya.com)
- * Licensed under the GPL
- */
-
-#ifndef __UM_ARCH_SIGNAL_I386_H
-#define __UM_ARCH_SIGNAL_I386_H
-
-struct arch_signal_context {
-        unsigned long extrasigs[_NSIG_WORDS];
-};
-
-#endif
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/include/asm-um/archparam-i386.h b/include/asm-um/archparam-i386.h
index 6f78de5b621b..49e89b8d7e58 100644
--- a/include/asm-um/archparam-i386.h
+++ b/include/asm-um/archparam-i386.h
@@ -6,143 +6,6 @@
 #ifndef __UM_ARCHPARAM_I386_H
 #define __UM_ARCHPARAM_I386_H
 
-/********* Bits for asm-um/elf.h ************/
-
-#include <asm/user.h>
-
-extern char * elf_aux_platform;
-#define ELF_PLATFORM (elf_aux_platform)
-
-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-
-typedef struct user_i387_struct elf_fpregset_t;
-typedef unsigned long elf_greg_t;
-
-#define ELF_NGREG (sizeof (struct user_regs_struct) / sizeof(elf_greg_t))
-typedef elf_greg_t elf_gregset_t[ELF_NGREG];
-
-#define ELF_DATA        ELFDATA2LSB
-#define ELF_ARCH        EM_386
-
-#define ELF_PLAT_INIT(regs, load_addr) do { \
-        PT_REGS_EBX(regs) = 0; \
-        PT_REGS_ECX(regs) = 0; \
-        PT_REGS_EDX(regs) = 0; \
-        PT_REGS_ESI(regs) = 0; \
-        PT_REGS_EDI(regs) = 0; \
-        PT_REGS_EBP(regs) = 0; \
-        PT_REGS_EAX(regs) = 0; \
-} while(0)
-
-/* Shamelessly stolen from include/asm-i386/elf.h */
-
-#define ELF_CORE_COPY_REGS(pr_reg, regs) do {   \
-        pr_reg[0] = PT_REGS_EBX(regs);          \
-        pr_reg[1] = PT_REGS_ECX(regs);          \
-        pr_reg[2] = PT_REGS_EDX(regs);          \
-        pr_reg[3] = PT_REGS_ESI(regs);          \
-        pr_reg[4] = PT_REGS_EDI(regs);          \
-        pr_reg[5] = PT_REGS_EBP(regs);          \
-        pr_reg[6] = PT_REGS_EAX(regs);          \
-        pr_reg[7] = PT_REGS_DS(regs);           \
-        pr_reg[8] = PT_REGS_ES(regs);           \
-        /* fake once used fs and gs selectors? */       \
-        pr_reg[9] = PT_REGS_DS(regs);           \
-        pr_reg[10] = PT_REGS_DS(regs);          \
-        pr_reg[11] = PT_REGS_SYSCALL_NR(regs);  \
-        pr_reg[12] = PT_REGS_IP(regs);          \
-        pr_reg[13] = PT_REGS_CS(regs);          \
-        pr_reg[14] = PT_REGS_EFLAGS(regs);      \
-        pr_reg[15] = PT_REGS_SP(regs);          \
-        pr_reg[16] = PT_REGS_SS(regs);          \
-} while(0);
-
-
-extern unsigned long vsyscall_ehdr;
-extern unsigned long vsyscall_end;
-extern unsigned long __kernel_vsyscall;
-
-#define VSYSCALL_BASE vsyscall_ehdr
-#define VSYSCALL_END vsyscall_end
-
-/*
- * This is the range that is readable by user mode, and things
- * acting like user mode such as get_user_pages.
- */
-#define FIXADDR_USER_START      VSYSCALL_BASE
-#define FIXADDR_USER_END        VSYSCALL_END
-
-/*
- * Architecture-neutral AT_ values in 0-17, leave some room
- * for more of them, start the x86-specific ones at 32.
- */
-#define AT_SYSINFO              32
-#define AT_SYSINFO_EHDR         33
-
-#define ARCH_DLINFO                                             \
-do {                                                            \
-        if ( vsyscall_ehdr ) {                                  \
-                NEW_AUX_ENT(AT_SYSINFO, __kernel_vsyscall);     \
-                NEW_AUX_ENT(AT_SYSINFO_EHDR, vsyscall_ehdr);    \
-        }                                                       \
-} while (0)
-
-/*
- * These macros parameterize elf_core_dump in fs/binfmt_elf.c to write out
- * extra segments containing the vsyscall DSO contents.  Dumping its
- * contents makes post-mortem fully interpretable later without matching up
- * the same kernel and hardware config to see what PC values meant.
- * Dumping its extra ELF program headers includes all the other information
- * a debugger needs to easily find how the vsyscall DSO was being used.
- */
-#define ELF_CORE_EXTRA_PHDRS                                                  \
-        (vsyscall_ehdr ? (((struct elfhdr *)vsyscall_ehdr)->e_phnum) : 0 )
-
-#define ELF_CORE_WRITE_EXTRA_PHDRS                                            \
-if ( vsyscall_ehdr ) {                                                        \
-        const struct elfhdr *const ehdrp = (struct elfhdr *)vsyscall_ehdr;    \
-        const struct elf_phdr *const phdrp =                                  \
-                (const struct elf_phdr *) (vsyscall_ehdr + ehdrp->e_phoff);   \
-        int i;                                                                \
-        Elf32_Off ofs = 0;                                                    \
-        for (i = 0; i < ehdrp->e_phnum; ++i) {                                \
-                struct elf_phdr phdr = phdrp[i];                              \
-                if (phdr.p_type == PT_LOAD) {                                 \
-                        ofs = phdr.p_offset = offset;                         \
-                        offset += phdr.p_filesz;                              \
-                }                                                             \
-                else                                                          \
-                        phdr.p_offset += ofs;                                 \
-                phdr.p_paddr = 0; /* match other core phdrs */                \
-                DUMP_WRITE(&phdr, sizeof(phdr));                              \
-        }                                                                     \
-}
-#define ELF_CORE_WRITE_EXTRA_DATA                                             \
-if ( vsyscall_ehdr ) {                                                        \
-        const struct elfhdr *const ehdrp = (struct elfhdr *)vsyscall_ehdr;    \
-        const struct elf_phdr *const phdrp =                                  \
-                (const struct elf_phdr *) (vsyscall_ehdr + ehdrp->e_phoff);   \
-        int i;                                                                \
-        for (i = 0; i < ehdrp->e_phnum; ++i) {                                \
-                if (phdrp[i].p_type == PT_LOAD)                               \
-                        DUMP_WRITE((void *) phdrp[i].p_vaddr,                 \
-                                   phdrp[i].p_filesz);                        \
-        }                                                                     \
-}
-
-#define R_386_NONE      0
-#define R_386_32        1
-#define R_386_PC32      2
-#define R_386_GOT32     3
-#define R_386_PLT32     4
-#define R_386_COPY      5
-#define R_386_GLOB_DAT  6
-#define R_386_JMP_SLOT  7
-#define R_386_RELATIVE  8
-#define R_386_GOTOFF    9
-#define R_386_GOTPC     10
-#define R_386_NUM       11
-
 /********* Nothing for asm-um/hardirq.h **********/
 
 /********* Nothing for asm-um/hw_irq.h **********/
diff --git a/include/asm-um/archparam-ppc.h b/include/asm-um/archparam-ppc.h
index 0ebced92a762..172cd6ffacc4 100644
--- a/include/asm-um/archparam-ppc.h
+++ b/include/asm-um/archparam-ppc.h
@@ -1,26 +1,6 @@
 #ifndef __UM_ARCHPARAM_PPC_H
 #define __UM_ARCHPARAM_PPC_H
 
-/********* Bits for asm-um/elf.h ************/
-
-#define ELF_PLATFORM (0)
-
-#define ELF_ET_DYN_BASE (0x08000000)
-
-/* the following stolen from asm-ppc/elf.h */
-#define ELF_NGREG       48      /* includes nip, msr, lr, etc. */
-#define ELF_NFPREG      33      /* includes fpscr */
-/* General registers */
-typedef unsigned long elf_greg_t;
-typedef elf_greg_t elf_gregset_t[ELF_NGREG];
-
-/* Floating point registers */
-typedef double elf_fpreg_t;
-typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
-
-#define ELF_DATA        ELFDATA2MSB
-#define ELF_ARCH        EM_PPC
-
 /********* Bits for asm-um/hw_irq.h **********/
 
 struct hw_interrupt_type;
diff --git a/include/asm-um/archparam-x86_64.h b/include/asm-um/archparam-x86_64.h
index 96321c4892f1..270ed9586b68 100644
--- a/include/asm-um/archparam-x86_64.h
+++ b/include/asm-um/archparam-x86_64.h
@@ -7,42 +7,6 @@
 #ifndef __UM_ARCHPARAM_X86_64_H
 #define __UM_ARCHPARAM_X86_64_H
 
-#include <asm/user.h>
-
-#define ELF_PLATFORM "x86_64"
-
-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
-
-typedef unsigned long elf_greg_t;
-typedef struct { } elf_fpregset_t;
-
-#define ELF_NGREG (sizeof (struct user_regs_struct) / sizeof(elf_greg_t))
-typedef elf_greg_t elf_gregset_t[ELF_NGREG];
-
-#define ELF_DATA        ELFDATA2LSB
-#define ELF_ARCH        EM_X86_64
-
-#define ELF_PLAT_INIT(regs, load_addr)    do { \
-        PT_REGS_RBX(regs) = 0; \
-        PT_REGS_RCX(regs) = 0; \
-        PT_REGS_RDX(regs) = 0; \
-        PT_REGS_RSI(regs) = 0; \
-        PT_REGS_RDI(regs) = 0; \
-        PT_REGS_RBP(regs) = 0; \
-        PT_REGS_RAX(regs) = 0; \
-        PT_REGS_R8(regs) = 0; \
-        PT_REGS_R9(regs) = 0; \
-        PT_REGS_R10(regs) = 0; \
-        PT_REGS_R11(regs) = 0; \
-        PT_REGS_R12(regs) = 0; \
-        PT_REGS_R13(regs) = 0; \
-        PT_REGS_R14(regs) = 0; \
-        PT_REGS_R15(regs) = 0; \
-} while (0)
-
-#ifdef TIF_IA32 /* XXX */
-        clear_thread_flag(TIF_IA32);
-#endif
 
 /* No user-accessible fixmap addresses, i.e. vsyscall */
 #define FIXADDR_USER_START      0
diff --git a/include/asm-um/delay.h b/include/asm-um/delay.h
index 40695576ca60..0985bda66750 100644
--- a/include/asm-um/delay.h
+++ b/include/asm-um/delay.h
@@ -4,4 +4,6 @@
 #include "asm/arch/delay.h"
 #include "asm/archparam.h"
 
+#define MILLION 1000000
+
 #endif
diff --git a/include/asm-um/elf-i386.h b/include/asm-um/elf-i386.h
new file mode 100644
index 000000000000..9bab712dc5c0
--- /dev/null
+++ b/include/asm-um/elf-i386.h
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2000 - 2003 Jeff Dike (jdike@addtoit.com)
+ * Licensed under the GPL
+ */
+#ifndef __UM_ELF_I386_H
+#define __UM_ELF_I386_H
+
+#include <asm/user.h>
+
+#define R_386_NONE      0
+#define R_386_32        1
+#define R_386_PC32      2
+#define R_386_GOT32     3
+#define R_386_PLT32     4
+#define R_386_COPY      5
+#define R_386_GLOB_DAT  6
+#define R_386_JMP_SLOT  7
+#define R_386_RELATIVE  8
+#define R_386_GOTOFF    9
+#define R_386_GOTPC     10
+#define R_386_NUM       11
+
+typedef unsigned long elf_greg_t;
+
+#define ELF_NGREG (sizeof (struct user_regs_struct) / sizeof(elf_greg_t))
+typedef elf_greg_t elf_gregset_t[ELF_NGREG];
+
+typedef struct user_i387_struct elf_fpregset_t;
+
+/*
+ * This is used to ensure we don't load something for the wrong architecture.
+ */
+#define elf_check_arch(x) \
+        (((x)->e_machine == EM_386) || ((x)->e_machine == EM_486))
+
+#define ELF_CLASS       ELFCLASS32
+#define ELF_DATA        ELFDATA2LSB
+#define ELF_ARCH        EM_386
+
+#define ELF_PLAT_INIT(regs, load_addr) do { \
+        PT_REGS_EBX(regs) = 0; \
+        PT_REGS_ECX(regs) = 0; \
+        PT_REGS_EDX(regs) = 0; \
+        PT_REGS_ESI(regs) = 0; \
+        PT_REGS_EDI(regs) = 0; \
+        PT_REGS_EBP(regs) = 0; \
+        PT_REGS_EAX(regs) = 0; \
+} while(0)
+
+#define USE_ELF_CORE_DUMP
+#define ELF_EXEC_PAGESIZE 4096
+
+#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
+
+/* Shamelessly stolen from include/asm-i386/elf.h */
+
+#define ELF_CORE_COPY_REGS(pr_reg, regs) do {   \
+        pr_reg[0] = PT_REGS_EBX(regs);          \
+        pr_reg[1] = PT_REGS_ECX(regs);          \
+        pr_reg[2] = PT_REGS_EDX(regs);          \
+        pr_reg[3] = PT_REGS_ESI(regs);          \
+        pr_reg[4] = PT_REGS_EDI(regs);          \
+        pr_reg[5] = PT_REGS_EBP(regs);          \
+        pr_reg[6] = PT_REGS_EAX(regs);          \
+        pr_reg[7] = PT_REGS_DS(regs);           \
+        pr_reg[8] = PT_REGS_ES(regs);           \
+        /* fake once used fs and gs selectors? */       \
+        pr_reg[9] = PT_REGS_DS(regs);           \
+        pr_reg[10] = PT_REGS_DS(regs);          \
+        pr_reg[11] = PT_REGS_SYSCALL_NR(regs);  \
+        pr_reg[12] = PT_REGS_IP(regs);          \
+        pr_reg[13] = PT_REGS_CS(regs);          \
+        pr_reg[14] = PT_REGS_EFLAGS(regs);      \
+        pr_reg[15] = PT_REGS_SP(regs);          \
+        pr_reg[16] = PT_REGS_SS(regs);          \
+} while(0);
+
+extern long elf_aux_hwcap;
+#define ELF_HWCAP (elf_aux_hwcap)
+
+extern char * elf_aux_platform;
+#define ELF_PLATFORM (elf_aux_platform)
+
+#define SET_PERSONALITY(ex, ibcs2) do ; while(0)
+
+extern unsigned long vsyscall_ehdr;
+extern unsigned long vsyscall_end;
+extern unsigned long __kernel_vsyscall;
+
+#define VSYSCALL_BASE vsyscall_ehdr
+#define VSYSCALL_END vsyscall_end
+
+/*
+ * This is the range that is readable by user mode, and things
+ * acting like user mode such as get_user_pages.
+ */
+#define FIXADDR_USER_START      VSYSCALL_BASE
+#define FIXADDR_USER_END        VSYSCALL_END
+
+/*
+ * Architecture-neutral AT_ values in 0-17, leave some room
+ * for more of them, start the x86-specific ones at 32.
+ */
+#define AT_SYSINFO              32
+#define AT_SYSINFO_EHDR         33
+
+#define ARCH_DLINFO                                             \
+do {                                                            \
+        if ( vsyscall_ehdr ) {                                  \
+                NEW_AUX_ENT(AT_SYSINFO, __kernel_vsyscall);     \
+                NEW_AUX_ENT(AT_SYSINFO_EHDR, vsyscall_ehdr);    \
+        }                                                       \
+} while (0)
+
+/*
+ * These macros parameterize elf_core_dump in fs/binfmt_elf.c to write out
+ * extra segments containing the vsyscall DSO contents.  Dumping its
+ * contents makes post-mortem fully interpretable later without matching up
+ * the same kernel and hardware config to see what PC values meant.
+ * Dumping its extra ELF program headers includes all the other information
+ * a debugger needs to easily find how the vsyscall DSO was being used.
+ */
+#define ELF_CORE_EXTRA_PHDRS                                                  \
+        (vsyscall_ehdr ? (((struct elfhdr *)vsyscall_ehdr)->e_phnum) : 0 )
+
+#define ELF_CORE_WRITE_EXTRA_PHDRS                                            \
+if ( vsyscall_ehdr ) {                                                        \
+        const struct elfhdr *const ehdrp = (struct elfhdr *)vsyscall_ehdr;    \
+        const struct elf_phdr *const phdrp =                                  \
+                (const struct elf_phdr *) (vsyscall_ehdr + ehdrp->e_phoff);   \
+        int i;                                                                \
+        Elf32_Off ofs = 0;                                                    \
+        for (i = 0; i < ehdrp->e_phnum; ++i) {                                \
+                struct elf_phdr phdr = phdrp[i];                              \
+                if (phdr.p_type == PT_LOAD) {                                 \
+                        ofs = phdr.p_offset = offset;                         \
+                        offset += phdr.p_filesz;                              \
+                }                                                             \
+                else                                                          \
+                        phdr.p_offset += ofs;                                 \
+                phdr.p_paddr = 0; /* match other core phdrs */                \
+                DUMP_WRITE(&phdr, sizeof(phdr));                              \
+        }                                                                     \
+}
+#define ELF_CORE_WRITE_EXTRA_DATA                                             \
+if ( vsyscall_ehdr ) {                                                        \
+        const struct elfhdr *const ehdrp = (struct elfhdr *)vsyscall_ehdr;    \
+        const struct elf_phdr *const phdrp =                                  \
+                (const struct elf_phdr *) (vsyscall_ehdr + ehdrp->e_phoff);   \
+        int i;                                                                \
+        for (i = 0; i < ehdrp->e_phnum; ++i) {                                \
+                if (phdrp[i].p_type == PT_LOAD)                               \
+                        DUMP_WRITE((void *) phdrp[i].p_vaddr,                 \
+                                   phdrp[i].p_filesz);                        \
+        }                                                                     \
+}
+
+#endif
+
+/*
+ * Overrides for Emacs so that we follow Linus's tabbing style.
+ * Emacs will notice this stuff at the end of the file and automatically
+ * adjust the settings for this buffer only.  This must remain at the end
+ * of the file.
+ * ---------------------------------------------------------------------------
+ * Local variables:
+ * c-file-style: "linux"
+ * End:
+ */
diff --git a/include/asm-um/elf.h b/include/asm-um/elf-ppc.h
index 7908f8fe8231..2998cf925042 100644
--- a/include/asm-um/elf.h
+++ b/include/asm-um/elf-ppc.h
@@ -1,8 +1,7 @@
-#ifndef __UM_ELF_H
-#define __UM_ELF_H
+#ifndef __UM_ELF_PPC_H
+#define __UM_ELF_PPC_H
 
 #include "linux/config.h"
-#include "asm/archparam.h"
 
 extern long elf_aux_hwcap;
 #define ELF_HWCAP (elf_aux_hwcap)
@@ -13,7 +12,7 @@ extern long elf_aux_hwcap;
 
 #define elf_check_arch(x) (1)
 
-#ifdef CONFIG_64BIT
+#ifdef CONFIG_64_BIT
 #define ELF_CLASS ELFCLASS64
 #else
 #define ELF_CLASS ELFCLASS32
@@ -34,4 +33,22 @@ extern long elf_aux_hwcap;
 #define R_386_GOTPC     10
 #define R_386_NUM       11
 
+#define ELF_PLATFORM (0)
+
+#define ELF_ET_DYN_BASE (0x08000000)
+
+/* the following stolen from asm-ppc/elf.h */
+#define ELF_NGREG       48      /* includes nip, msr, lr, etc. */
+#define ELF_NFPREG      33      /* includes fpscr */
+/* General registers */
+typedef unsigned long elf_greg_t;
+typedef elf_greg_t elf_gregset_t[ELF_NGREG];
+
+/* Floating point registers */
+typedef double elf_fpreg_t;
+typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
+
+#define ELF_DATA        ELFDATA2MSB
+#define ELF_ARCH        EM_PPC
+
 #endif
diff --git a/include/asm-um/elf-x86_64.h b/include/asm-um/elf-x86_64.h
new file mode 100644
index 000000000000..8a8246d03936
--- /dev/null
+++ b/include/asm-um/elf-x86_64.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2003 PathScale, Inc.
+ *
+ * Licensed under the GPL
+ */
+#ifndef __UM_ELF_X86_64_H
+#define __UM_ELF_X86_64_H
+
+#include <asm/user.h>
+
+/* x86-64 relocation types, taken from asm-x86_64/elf.h */
+#define R_X86_64_NONE           0       /* No reloc */
+#define R_X86_64_64             1       /* Direct 64 bit  */
+#define R_X86_64_PC32           2       /* PC relative 32 bit signed */
+#define R_X86_64_GOT32          3       /* 32 bit GOT entry */
+#define R_X86_64_PLT32          4       /* 32 bit PLT address */
+#define R_X86_64_COPY           5       /* Copy symbol at runtime */
+#define R_X86_64_GLOB_DAT       6       /* Create GOT entry */
+#define R_X86_64_JUMP_SLOT      7       /* Create PLT entry */
+#define R_X86_64_RELATIVE       8       /* Adjust by program base */
+#define R_X86_64_GOTPCREL       9       /* 32 bit signed pc relative
+                                           offset to GOT */
+#define R_X86_64_32             10      /* Direct 32 bit zero extended */
+#define R_X86_64_32S            11      /* Direct 32 bit sign extended */
+#define R_X86_64_16             12      /* Direct 16 bit zero extended */
+#define R_X86_64_PC16           13      /* 16 bit sign extended pc relative */
+#define R_X86_64_8              14      /* Direct 8 bit sign extended  */
+#define R_X86_64_PC8            15      /* 8 bit sign extended pc relative */
+
+#define R_X86_64_NUM            16
+
+typedef unsigned long elf_greg_t;
+
+#define ELF_NGREG (sizeof (struct user_regs_struct) / sizeof(elf_greg_t))
+typedef elf_greg_t elf_gregset_t[ELF_NGREG];
+
+typedef struct { } elf_fpregset_t;
+
+/*
+ * This is used to ensure we don't load something for the wrong architecture.
+ */
+#define elf_check_arch(x) \
+        ((x)->e_machine == EM_X86_64)
+
+#define ELF_CLASS       ELFCLASS64
+#define ELF_DATA        ELFDATA2LSB
+#define ELF_ARCH        EM_X86_64
+
+#define ELF_PLAT_INIT(regs, load_addr)    do { \
+        PT_REGS_RBX(regs) = 0; \
+        PT_REGS_RCX(regs) = 0; \
+        PT_REGS_RDX(regs) = 0; \
+        PT_REGS_RSI(regs) = 0; \
+        PT_REGS_RDI(regs) = 0; \
+        PT_REGS_RBP(regs) = 0; \
+        PT_REGS_RAX(regs) = 0; \
+        PT_REGS_R8(regs) = 0; \
+        PT_REGS_R9(regs) = 0; \
+        PT_REGS_R10(regs) = 0; \
+        PT_REGS_R11(regs) = 0; \
+        PT_REGS_R12(regs) = 0; \
+        PT_REGS_R13(regs) = 0; \
+        PT_REGS_R14(regs) = 0; \
+        PT_REGS_R15(regs) = 0; \
+} while (0)
+
+#ifdef TIF_IA32 /* XXX */
+#error XXX, indeed
+        clear_thread_flag(TIF_IA32);
+#endif
+
+#define USE_ELF_CORE_DUMP
+#define ELF_EXEC_PAGESIZE 4096
+
+#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
+
+extern long elf_aux_hwcap;
+#define ELF_HWCAP (elf_aux_hwcap)
+
+#define ELF_PLATFORM "x86_64"
+
+#define SET_PERSONALITY(ex, ibcs2) do ; while(0)
+
+#endif
+
+/*
+ * Overrides for Emacs so that we follow Linus's tabbing style.
+ * Emacs will notice this stuff at the end of the file and automatically
+ * adjust the settings for this buffer only.  This must remain at the end
+ * of the file.
+ * ---------------------------------------------------------------------------
+ * Local variables:
+ * c-file-style: "linux"
+ * End:
+ */
diff --git a/include/asm-um/fixmap.h b/include/asm-um/fixmap.h
index 900f3fbb9fab..ae0ca3932d50 100644
--- a/include/asm-um/fixmap.h
+++ b/include/asm-um/fixmap.h
@@ -4,6 +4,7 @@
 #include <linux/config.h>
 #include <asm/kmap_types.h>
 #include <asm/archparam.h>
+#include <asm/elf.h>
 
 /*
  * Here we define all the compile-time 'special' virtual
diff --git a/include/asm-um/ipc.h b/include/asm-um/ipc.h
index e2ddc47f3e52..a46e3d9c2a3f 100644
--- a/include/asm-um/ipc.h
+++ b/include/asm-um/ipc.h
@@ -1,6 +1 @@
-#ifndef __UM_IPC_H
-#define __UM_IPC_H
-
-#include "asm/arch/ipc.h"
-
-#endif
+#include <asm-generic/ipc.h>
diff --git a/include/asm-um/linkage.h b/include/asm-um/linkage.h
index 27011652b015..7dfce37adc8b 100644
--- a/include/asm-um/linkage.h
+++ b/include/asm-um/linkage.h
@@ -1,7 +1,6 @@
-#ifndef __ASM_LINKAGE_H
-#define __ASM_LINKAGE_H
+#ifndef __ASM_UM_LINKAGE_H
+#define __ASM_UM_LINKAGE_H
 
-#define FASTCALL(x)     x __attribute__((regparm(3)))
-#define fastcall        __attribute__((regparm(3)))
+#include "asm/arch/linkage.h"
 
 #endif
diff --git a/include/asm-um/page.h b/include/asm-um/page.h
index 102eb3df1aaf..504ea8e486b0 100644
--- a/include/asm-um/page.h
+++ b/include/asm-um/page.h
@@ -45,6 +45,9 @@ typedef struct { unsigned long pgd; } pgd_t;
         ({ (pte).pte_high = (phys) >> 32; \
            (pte).pte_low = (phys) | pgprot_val(prot); })
 
+#define pmd_val(x)      ((x).pmd)
+#define __pmd(x) ((pmd_t) { (x) } )
+
 typedef unsigned long long pfn_t;
 typedef unsigned long long phys_t;
 
diff --git a/include/asm-um/pgtable-3level.h b/include/asm-um/pgtable-3level.h
index d309f3a9e6f6..65e8bfc55fc4 100644
--- a/include/asm-um/pgtable-3level.h
+++ b/include/asm-um/pgtable-3level.h
@@ -149,7 +149,7 @@ static inline pmd_t pfn_pmd(pfn_t page_nr, pgprot_t pgprot)
 
 #define pte_to_pgoff(p) ((p).pte >> 32)
 
-#define pgoff_to_pte(off) ((pte_t) { ((off) < 32) | _PAGE_FILE })
+#define pgoff_to_pte(off) ((pte_t) { ((off) << 32) | _PAGE_FILE })
 
 #else
 
diff --git a/include/asm-um/pgtable.h b/include/asm-um/pgtable.h
index 71f9c0c78c0c..510e513c7f88 100644
--- a/include/asm-um/pgtable.h
+++ b/include/asm-um/pgtable.h
@@ -106,7 +106,7 @@ extern unsigned long end_iomem;
 /*
  * Define this if things work differently on an i386 and an i486:
  * it will (on an i486) warn about kernel memory accesses that are
- * done without a 'verify_area(VERIFY_WRITE,..)'
+ * done without a 'access_ok(VERIFY_WRITE,..)'
  */
 #undef TEST_VERIFY_AREA
 
diff --git a/include/asm-um/processor-generic.h b/include/asm-um/processor-generic.h
index b953b1ad3b02..b2fc94fbc2d9 100644
--- a/include/asm-um/processor-generic.h
+++ b/include/asm-um/processor-generic.h
@@ -24,9 +24,6 @@ struct thread_struct {
         int forking;
         int nsyscalls;
         struct pt_regs regs;
-        unsigned long cr2;
-        int err;
-        unsigned long trap_no;
         int singlestep_syscall;
         void *fault_addr;
         void *fault_catcher;
@@ -74,8 +71,6 @@ struct thread_struct {
         .forking                = 0, \
         .nsyscalls              = 0, \
         .regs                   = EMPTY_REGS, \
-        .cr2                    = 0, \
-        .err                    = 0, \
         .fault_addr             = NULL, \
         .prev_sched             = NULL, \
         .temp_stack             = 0, \
diff --git a/include/asm-um/processor-i386.h b/include/asm-um/processor-i386.h
index 2deb8f1adbf1..431bad3ae9d7 100644
--- a/include/asm-um/processor-i386.h
+++ b/include/asm-um/processor-i386.h
@@ -9,13 +9,18 @@
 extern int host_has_xmm;
 extern int host_has_cmov;
 
+/* include faultinfo structure */
+#include "sysdep/faultinfo.h"
+
 struct arch_thread {
         unsigned long debugregs[8];
         int debugregs_seq;
+        struct faultinfo faultinfo;
 };
 
 #define INIT_ARCH_THREAD { .debugregs           = { [ 0 ... 7 ] = 0 }, \
-                           .debugregs_seq       = 0 }
+                           .debugregs_seq       = 0, \
+                           .faultinfo           = { 0, 0, 0 } }
 
 #include "asm/arch/user.h"
 
diff --git a/include/asm-um/processor-x86_64.h b/include/asm-um/processor-x86_64.h
index a1ae3a4cd938..0beb9a42ae05 100644
--- a/include/asm-um/processor-x86_64.h
+++ b/include/asm-um/processor-x86_64.h
@@ -7,9 +7,13 @@
 #ifndef __UM_PROCESSOR_X86_64_H
 #define __UM_PROCESSOR_X86_64_H
 
-#include "asm/arch/user.h"
+/* include faultinfo structure */
+#include "sysdep/faultinfo.h"
 
 struct arch_thread {
+        unsigned long debugregs[8];
+        int debugregs_seq;
+        struct faultinfo faultinfo;
 };
 
 /* REP NOP (PAUSE) is a good thing to insert into busy-wait loops. */
@@ -20,7 +24,11 @@ extern inline void rep_nop(void)
 
 #define cpu_relax()   rep_nop()
 
-#define INIT_ARCH_THREAD { }
+#define INIT_ARCH_THREAD { .debugregs           = { [ 0 ... 7 ] = 0 }, \
+                           .debugregs_seq       = 0, \
+                           .faultinfo           = { 0, 0, 0 } }
+
+#include "asm/arch/user.h"
 
 #define current_text_addr() \
         ({ void *pc; __asm__("movq $1f,%0\n1:":"=g" (pc)); pc; })
diff --git a/include/asm-um/setup.h b/include/asm-um/setup.h
index c85252e803c1..99f086301f4c 100644
--- a/include/asm-um/setup.h
+++ b/include/asm-um/setup.h
@@ -2,7 +2,8 @@
 #define SETUP_H_INCLUDED
 
 /* POSIX mandated with _POSIX_ARG_MAX that we can rely on 4096 chars in the
- * command line, so this choice is ok.*/
+ * command line, so this choice is ok.
+ */
 
 #define COMMAND_LINE_SIZE 4096
 
diff --git a/include/asm-x86_64/apicdef.h b/include/asm-x86_64/apicdef.h
index 3d7627ffe67d..bfebdb690654 100644
--- a/include/asm-x86_64/apicdef.h
+++ b/include/asm-x86_64/apicdef.h
@@ -112,7 +112,7 @@
 
 #define APIC_BASE (fix_to_virt(FIX_APIC_BASE))
 
-#define MAX_IO_APICS 32
+#define MAX_IO_APICS 128
 
 /*
  * All x86-64 systems are xAPIC compatible.
diff --git a/include/asm-x86_64/floppy.h b/include/asm-x86_64/floppy.h
index bca9b28a1a0a..af7ded63b517 100644
--- a/include/asm-x86_64/floppy.h
+++ b/include/asm-x86_64/floppy.h
@@ -223,7 +223,7 @@ static int hard_dma_setup(char *addr, unsigned long size, int mode, int io)
         return 0;
 }
 
-struct fd_routine_l {
+static struct fd_routine_l {
         int (*_request_dma)(unsigned int dmanr, const char * device_id);
         void (*_free_dma)(unsigned int dmanr);
         int (*_get_dma_residue)(unsigned int dummy);
diff --git a/include/asm-x86_64/io_apic.h b/include/asm-x86_64/io_apic.h
index 7efc932e8f0b..32573749004c 100644
--- a/include/asm-x86_64/io_apic.h
+++ b/include/asm-x86_64/io_apic.h
@@ -202,7 +202,6 @@ extern int skip_ioapic_setup;
 #define io_apic_assign_pci_irqs (mp_irq_entries && !skip_ioapic_setup && io_apic_irqs)
 
 #ifdef CONFIG_ACPI_BOOT
-extern int io_apic_get_unique_id (int ioapic, int apic_id);
 extern int io_apic_get_version (int ioapic);
 extern int io_apic_get_redir_entries (int ioapic);
 extern int io_apic_set_pci_routing (int ioapic, int pin, int irq, int, int);
diff --git a/include/asm-x86_64/ioctl32.h b/include/asm-x86_64/ioctl32.h
deleted file mode 100644
index d0d227f45e05..000000000000
--- a/include/asm-x86_64/ioctl32.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <linux/ioctl32.h>
diff --git a/include/asm-x86_64/nmi.h b/include/asm-x86_64/nmi.h
index 21d56b086b9d..d3abfc6a8fd5 100644
--- a/include/asm-x86_64/nmi.h
+++ b/include/asm-x86_64/nmi.h
@@ -53,5 +53,7 @@ extern void die_nmi(char *str, struct pt_regs *regs);
 
 extern int panic_on_timeout;
 extern int unknown_nmi_panic;
+
+extern int check_nmi_watchdog(void);
  
 #endif /* ASM_NMI_H */
diff --git a/include/asm-x86_64/processor.h b/include/asm-x86_64/processor.h
index f0581c35628e..d641b19f6da5 100644
--- a/include/asm-x86_64/processor.h
+++ b/include/asm-x86_64/processor.h
@@ -62,7 +62,6 @@ struct cpuinfo_x86 {
         int     x86_tlbsize;    /* number of 4K pages in DTLB/ITLB combined(in pages)*/
         __u8    x86_virt_bits, x86_phys_bits;
         __u8    x86_num_cores;
-        __u8    x86_apicid;
         __u32   x86_power;      
         __u32   extended_cpuid_level;   /* Max extended CPUID function supported */
         unsigned long loops_per_jiffy;
@@ -159,9 +158,9 @@ static inline void clear_in_cr4 (unsigned long mask)
 
 
 /*
- * User space process size. 47bits.
+ * User space process size. 47bits minus one guard page.
  */
-#define TASK_SIZE       (0x800000000000UL)
+#define TASK_SIZE       (0x800000000000UL - 4096)
 
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index d0f8f8b4c394..f2f073642d62 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -30,6 +30,11 @@ extern void ia32_syscall(void);
 extern void iommu_hole_init(void);
 
 extern void time_init_gtod(void);
+extern int pmtimer_mark_offset(void);
+extern unsigned int do_gettimeoffset_pm(void);
+extern u32 pmtmr_ioport;
+extern unsigned long long monotonic_base;
+extern int sysctl_vsyscall;
 
 extern void do_softirq_thunk(void);
 
diff --git a/include/asm-x86_64/vsyscall.h b/include/asm-x86_64/vsyscall.h
index b0c8d4339906..2872da23fc7e 100644
--- a/include/asm-x86_64/vsyscall.h
+++ b/include/asm-x86_64/vsyscall.h
@@ -25,6 +25,7 @@ enum vsyscall_num {
 
 #define VXTIME_TSC      1
 #define VXTIME_HPET     2
+#define VXTIME_PMTMR    3
 
 struct vxtime_data {
         long hpet_address;      /* HPET base address */
@@ -54,6 +55,8 @@ extern struct timezone sys_tz;
 extern int sysctl_vsyscall;
 extern seqlock_t xtime_lock;
 
+extern int sysctl_vsyscall;
+
 #define ARCH_HAVE_XTIME_LOCK 1
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/awe_voice.h b/include/linux/awe_voice.h
index da0e27de752c..4bf9f33048e2 100644
--- a/include/linux/awe_voice.h
+++ b/include/linux/awe_voice.h
@@ -29,9 +29,9 @@
 #define SAMPLE_TYPE_AWE32       0x20
 #endif
 
-#ifndef _PATCHKEY
-#define _PATCHKEY(id) ((id<<8)|0xfd)
-#endif
+#define _LINUX_PATCHKEY_H_INDIRECT
+#include <linux/patchkey.h>
+#undef _LINUX_PATCHKEY_H_INDIRECT
 
 /*----------------------------------------------------------------
  * patch information record
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 54f820832c73..7e736e201c46 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -77,7 +77,6 @@ extern int flush_old_exec(struct linux_binprm * bprm);
 extern int setup_arg_pages(struct linux_binprm * bprm,
                            unsigned long stack_top,
                            int executable_stack);
-extern int copy_strings(int argc,char __user * __user * argv,struct linux_binprm *bprm); 
 extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
 extern void compute_creds(struct linux_binprm *binprm);
 extern int do_coredump(long signr, int exit_code, struct pt_regs * regs);
diff --git a/include/linux/device.h b/include/linux/device.h
index cf470459fa69..df94c0de53f2 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -273,9 +273,6 @@ struct device {
                                            BIOS data relevant to device) */
         struct dev_pm_info      power;
 
-        u32             detach_state;   /* State to enter when device is
-                                           detached from its driver. */
-
         u64             *dma_mask;      /* dma mask (if dma'able device) */
         u64             coherent_dma_mask;/* Like dma_mask, but for
                                              alloc_coherent mappings as
diff --git a/include/linux/err.h b/include/linux/err.h
index 17c55df13615..ff71d2af5da3 100644
--- a/include/linux/err.h
+++ b/include/linux/err.h
@@ -13,6 +13,8 @@
  * This should be a per-architecture thing, to allow different
  * error and pointer decisions.
  */
+#define IS_ERR_VALUE(x) unlikely((x) > (unsigned long)-1000L)
+
 static inline void *ERR_PTR(long error)
 {
         return (void *) error;
@@ -25,7 +27,7 @@ static inline long PTR_ERR(const void *ptr)
 
 static inline long IS_ERR(const void *ptr)
 {
-        return unlikely((unsigned long)ptr > (unsigned long)-1000L);
+        return IS_ERR_VALUE((unsigned long)ptr);
 }
 
 #endif /* _LINUX_ERR_H */
diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 396c48cbaeb1..220748b7abea 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)eth.h       1.0.4   05/13/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              Relocated to include/linux where it belongs by Alan Cox 
diff --git a/include/linux/fddidevice.h b/include/linux/fddidevice.h
index 2e5ee47f3e1e..002f6367697d 100644
--- a/include/linux/fddidevice.h
+++ b/include/linux/fddidevice.h
@@ -10,7 +10,7 @@
  * Author:      Lawrence V. Stefani, <stefani@lkg.dec.com>
  *
  *              fddidevice.h is based on previous trdevice.h work by
- *                      Ross Biro, <bir7@leland.Stanford.Edu>
+ *                      Ross Biro
  *                      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                      Alan Cox, <gw4pts@gw4pts.ampr.org>
  *
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 4edba067a717..0180102dace1 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1341,7 +1341,7 @@ extern int fs_may_remount_ro(struct super_block *);
 
 extern int check_disk_change(struct block_device *);
 extern int invalidate_inodes(struct super_block *);
-extern int __invalidate_device(struct block_device *, int);
+extern int __invalidate_device(struct block_device *);
 extern int invalidate_partition(struct gendisk *, int);
 unsigned long invalidate_mapping_pages(struct address_space *mapping,
                                         pgoff_t start, pgoff_t end);
diff --git a/include/linux/hippidevice.h b/include/linux/hippidevice.h
index 89b3a4a5b761..9debe6bbe5f0 100644
--- a/include/linux/hippidevice.h
+++ b/include/linux/hippidevice.h
@@ -10,7 +10,7 @@
  * Author:      Jes Sorensen, <Jes.Sorensen@cern.ch>
  *
  *              hippidevice.h is based on previous fddidevice.h work by
- *                      Ross Biro, <bir7@leland.Stanford.Edu>
+ *                      Ross Biro
  *                      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                      Alan Cox, <gw4pts@gw4pts.ampr.org>
  *                      Lawrence V. Stefani, <stefani@lkg.dec.com>
diff --git a/include/linux/if.h b/include/linux/if.h
index 110282dbd3e0..d73a9d62f208 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -8,7 +8,7 @@
  * Version:     @(#)if.h        1.0.2   04/18/93
  *
  * Authors:     Original taken from Berkeley UNIX 4.3, (c) UCB 1982-1988
- *              Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              This program is free software; you can redistribute it and/or
diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
index bbf49bcd7705..0856548a2a08 100644
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -9,7 +9,7 @@
  *
  * Authors:     Original taken from Berkeley UNIX 4.3, (c) UCB 1986-1988
  *              Portions taken from the KA9Q/NOS (v2.00m PA0GRI) source.
- *              Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Florian La Roche,
  *              Jonathan Layes <layes@loran.com>
diff --git a/include/linux/if_ltalk.h b/include/linux/if_ltalk.h
index e75e832b7ff0..76525760ba48 100644
--- a/include/linux/if_ltalk.h
+++ b/include/linux/if_ltalk.h
@@ -6,7 +6,7 @@
 #define LTALK_ALEN              1
 
 #ifdef __KERNEL__
-extern void ltalk_setup(struct net_device *);
+extern struct net_device *alloc_ltalkdev(int sizeof_priv);
 #endif
 
 #endif
diff --git a/include/linux/ixjuser.h b/include/linux/ixjuser.h
index 88121166d715..fd1756d3a47e 100644
--- a/include/linux/ixjuser.h
+++ b/include/linux/ixjuser.h
@@ -42,8 +42,6 @@
  *
  *****************************************************************************/
 
-static char ixjuser_h_rcsid[] = "$Id: ixjuser.h,v 4.1 2001/08/05 00:17:37 craigs Exp $";
-
 #include <linux/telephony.h>
 
 
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index f20c163de4f5..99ddba5a4e00 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -43,6 +43,9 @@ typedef int (*kprobe_fault_handler_t) (struct kprobe *, struct pt_regs *,
 struct kprobe {
         struct hlist_node hlist;
 
+        /* list of kprobes for multi-handler support */
+        struct list_head list;
+
         /* location of the probe point */
         kprobe_opcode_t *addr;
 
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 505160ab472b..1f7e2039a04e 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -584,6 +584,13 @@ static inline void scr_write(struct ata_port *ap, unsigned int reg, u32 val)
         ap->ops->scr_write(ap, reg, val);
 }
 
+static inline void scr_write_flush(struct ata_port *ap, unsigned int reg, 
+                                   u32 val)
+{
+        ap->ops->scr_write(ap, reg, val);
+        (void) ap->ops->scr_read(ap, reg);
+}
+
 static inline unsigned int sata_dev_present(struct ata_port *ap)
 {
         return ((scr_read(ap, SCR_STATUS) & 0xf) == 0x3) ? 1 : 0;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 8b007ad2d450..17518fe0b311 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -637,9 +637,9 @@ extern unsigned long do_mremap(unsigned long addr,
  * These functions are passed a count `nr_to_scan' and a gfpmask.  They should
  * scan `nr_to_scan' objects, attempting to free them.
  *
- * The callback must the number of objects which remain in the cache.
+ * The callback must return the number of objects which remain in the cache.
  *
- * The callback will be passes nr_to_scan == 0 when the VM is querying the
+ * The callback will be passed nr_to_scan == 0 when the VM is querying the
  * cache size, so a fastpath for that case is appropriate.
  */
 typedef int (*shrinker_t)(int nr_to_scan, unsigned int gfp_mask);
diff --git a/include/linux/mpage.h b/include/linux/mpage.h
index dea1b0083661..3ca880463c47 100644
--- a/include/linux/mpage.h
+++ b/include/linux/mpage.h
@@ -20,9 +20,6 @@ int mpage_writepages(struct address_space *mapping,
                 struct writeback_control *wbc, get_block_t get_block);
 int mpage_writepage(struct page *page, get_block_t *get_block,
                 struct writeback_control *wbc);
-int __mpage_writepages(struct address_space *mapping,
-                struct writeback_control *wbc, get_block_t get_block,
-                writepage_t writepage);
 
 static inline int
 generic_writepages(struct address_space *mapping, struct writeback_control *wbc)
diff --git a/include/linux/net.h b/include/linux/net.h
index e5914c1f0c4d..6d997ff3f103 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -7,7 +7,7 @@
  * Version:     @(#)net.h       1.0.3   05/25/93
  *
  * Authors:     Orest Zborowski, <obz@Kodak.COM>
- *              Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              This program is free software; you can redistribute it and/or
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 8d775be67833..ac11d73be4ce 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)dev.h       1.0.10  08/12/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
  *              Donald J. Becker, <becker@cesdis.gsfc.nasa.gov>
diff --git a/include/linux/patchkey.h b/include/linux/patchkey.h
new file mode 100644
index 000000000000..d974a6e92372
--- /dev/null
+++ b/include/linux/patchkey.h
@@ -0,0 +1,45 @@
+/*
+ * <linux/patchkey.h> -- definition of _PATCHKEY macro
+ *
+ * Copyright (C) 2005 Stuart Brady
+ *
+ * This exists because awe_voice.h defined its own _PATCHKEY and it wasn't
+ * clear whether removing this would break anything in userspace.
+ *
+ * Do not include this file directly.  Please use <sys/soundcard.h> instead.
+ * For kernel code, use <linux/soundcard.h>
+ */
+
+#ifndef _LINUX_PATCHKEY_H_INDIRECT
+#error "patchkey.h included directly"
+#endif
+
+#ifndef _LINUX_PATCHKEY_H
+#define _LINUX_PATCHKEY_H
+
+/* Endian macros. */
+#ifdef __KERNEL__
+#  include <asm/byteorder.h>
+#else
+#  include <endian.h>
+#endif
+
+#if defined(__KERNEL__)
+#  if defined(__BIG_ENDIAN)
+#    define _PATCHKEY(id) (0xfd00|id)
+#  elif defined(__LITTLE_ENDIAN)
+#    define _PATCHKEY(id) ((id<<8)|0x00fd)
+#  else
+#    error "could not determine byte order"
+#  endif
+#elif defined(__BYTE_ORDER)
+#  if __BYTE_ORDER == __BIG_ENDIAN
+#    define _PATCHKEY(id) (0xfd00|id)
+#  elif __BYTE_ORDER == __LITTLE_ENDIAN
+#    define _PATCHKEY(id) ((id<<8)|0x00fd)
+#  else
+#    error "could not determine byte order"
+#  endif
+#endif
+
+#endif /* _LINUX_PATCHKEY_H */
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 5d5820a4cf10..ae27792b5aa4 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -854,6 +854,7 @@
 #define PCI_DEVICE_ID_MYLEX_DAC960_LA   0x0020
 #define PCI_DEVICE_ID_MYLEX_DAC960_LP   0x0050
 #define PCI_DEVICE_ID_MYLEX_DAC960_BA   0xBA56
+#define PCI_DEVICE_ID_MYLEX_DAC960_GEM  0xB166
 
 #define PCI_VENDOR_ID_PICOP             0x1066
 #define PCI_DEVICE_ID_PICOP_PT86C52X    0x0001
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 5f868a588581..4dbb109022f3 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -578,7 +578,7 @@ struct task_struct {
         unsigned long flags;    /* per process flags, defined below */
         unsigned long ptrace;
 
-        int lock_depth;         /* Lock depth */
+        int lock_depth;         /* BKL lock depth */
 
         int prio, static_prio;
         struct list_head run_list;
@@ -661,7 +661,10 @@ struct task_struct {
         struct key *thread_keyring;     /* keyring private to this thread */
 #endif
         int oomkilladj; /* OOM kill score adjustment (bit shift). */
-        char comm[TASK_COMM_LEN];
+        char comm[TASK_COMM_LEN]; /* executable name excluding path
+                                     - access with [gs]et_task_comm (which lock
+                                       it with task_lock())
+                                     - initialized normally by flush_old_exec */
 /* file system info */
         int link_count, total_link_count;
 /* ipc stuff */
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index c3fb5984f250..d6025af7efac 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -479,6 +479,25 @@ uart_handle_cts_change(struct uart_port *port, unsigned int status)
         }
 }
 
+#include <linux/tty_flip.h>
+
+static inline void
+uart_insert_char(struct uart_port *port, unsigned int status,
+                 unsigned int overrun, unsigned int ch, unsigned int flag)
+{
+        struct tty_struct *tty = port->info->tty;
+
+        if ((status & port->ignore_status_mask & ~overrun) == 0)
+                tty_insert_flip_char(tty, ch, flag);
+
+        /*
+         * Overrun is special.  Since it's reported immediately,
+         * it doesn't affect the current character.
+         */
+        if (status & ~port->ignore_status_mask & overrun)
+                tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+}
+
 /*
  *      UART_ENABLE_MS - determine if port should enable modem status irqs
  */
diff --git a/include/linux/sockios.h b/include/linux/sockios.h
index 5eb33205cc04..e6b9d1d36ea2 100644
--- a/include/linux/sockios.h
+++ b/include/linux/sockios.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)sockios.h   1.0.2   03/09/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              This program is free software; you can redistribute it and/or
diff --git a/include/linux/soundcard.h b/include/linux/soundcard.h
index 28d2d1881978..523d069c862c 100644
--- a/include/linux/soundcard.h
+++ b/include/linux/soundcard.h
@@ -39,6 +39,13 @@
 /* In Linux we need to be prepared for cross compiling */
 #include <linux/ioctl.h>
 
+/* Endian macros. */
+#ifdef __KERNEL__
+#  include <asm/byteorder.h>
+#else
+#  include <endian.h>
+#endif
+
 /*
  *      Supported card ID numbers (Should be somewhere else?)
  */
@@ -179,13 +186,26 @@ typedef struct seq_event_rec {
  * Some big endian/little endian handling macros
  */
 
-#if defined(_AIX) || defined(AIX) || defined(sparc) || defined(__sparc__) || defined(HPPA) || defined(PPC) || defined(__mc68000__)
-/* Big endian machines */
-#  define _PATCHKEY(id) (0xfd00|id)
-#  define AFMT_S16_NE AFMT_S16_BE
-#else
-#  define _PATCHKEY(id) ((id<<8)|0xfd)
-#  define AFMT_S16_NE AFMT_S16_LE
+#define _LINUX_PATCHKEY_H_INDIRECT
+#include <linux/patchkey.h>
+#undef _LINUX_PATCHKEY_H_INDIRECT
+
+#if defined(__KERNEL__)
+#  if defined(__BIG_ENDIAN)
+#    define AFMT_S16_NE AFMT_S16_BE
+#  elif defined(__LITTLE_ENDIAN)
+#    define AFMT_S16_NE AFMT_S16_LE
+#  else
+#    error "could not determine byte order"
+#  endif
+#elif defined(__BYTE_ORDER)
+#  if __BYTE_ORDER == __BIG_ENDIAN
+#    define AFMT_S16_NE AFMT_S16_BE
+#  elif __BYTE_ORDER == __LITTLE_ENDIAN
+#    define AFMT_S16_NE AFMT_S16_LE
+#  else
+#    error "could not determine byte order"
+#  endif
 #endif
 
 /*
diff --git a/include/linux/trdevice.h b/include/linux/trdevice.h
index aaa1f337edcb..99e02ef54c47 100644
--- a/include/linux/trdevice.h
+++ b/include/linux/trdevice.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)eth.h       1.0.4   05/13/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              Relocated to include/linux where it belongs by Alan Cox 
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index 3a358c895188..6409d9cf5965 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -41,6 +41,7 @@ extern struct vm_struct *get_vm_area(unsigned long size, unsigned long flags);
 extern struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
                                         unsigned long start, unsigned long end);
 extern struct vm_struct *remove_vm_area(void *addr);
+extern struct vm_struct *__remove_vm_area(void *addr);
 extern int map_vm_area(struct vm_struct *area, pgprot_t prot,
                         struct page ***pages);
 extern void unmap_vm_area(struct vm_struct *area);
diff --git a/include/media/video-buf-dvb.h b/include/media/video-buf-dvb.h
index 94bd33619aa5..ad0a07a3a895 100644
--- a/include/media/video-buf-dvb.h
+++ b/include/media/video-buf-dvb.h
@@ -16,7 +16,7 @@ struct videobuf_dvb {
         int                        nfeeds;
 
         /* videobuf_dvb_(un)register manges this */
-        struct dvb_adapter         *adapter;
+        struct dvb_adapter         adapter;
         struct dvb_demux           demux;
         struct dmxdev              dmxdev;
         struct dmx_frontend        fe_hw;
diff --git a/include/net/act_generic.h b/include/net/act_generic.h
index 95b120781c14..c9daa7e52300 100644
--- a/include/net/act_generic.h
+++ b/include/net/act_generic.h
@@ -2,8 +2,8 @@
  * include/net/act_generic.h
  *
 */
-#ifndef ACT_GENERIC_H
-#define ACT_GENERIC_H
+#ifndef _NET_ACT_GENERIC_H
+#define _NET_ACT_GENERIC_H
 static inline int tcf_defact_release(struct tcf_defact *p, int bind)
 {
         int ret = 0;
diff --git a/include/net/icmp.h b/include/net/icmp.h
index 3fc192478aa2..e5ef0d15fb45 100644
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)icmp.h      1.0.4   05/13/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              This program is free software; you can redistribute it and/or
diff --git a/include/net/ip.h b/include/net/ip.h
index b4db1375da2c..3f63992eb712 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)ip.h        1.0.2   05/07/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  *
diff --git a/include/net/route.h b/include/net/route.h
index 22da7579d5de..efe92b239ef1 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)route.h     1.0.4   05/27/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  * Fixes:
  *              Alan Cox        :       Reformatted. Added ip_rt_local()
diff --git a/include/net/sock.h b/include/net/sock.h
index cc4c9190b7fd..a9ef3a6a13f3 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)sock.h      1.0.4   05/13/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
  *              Florian La Roche <flla@stud.uni-sb.de>
@@ -141,6 +141,7 @@ struct sock_common {
   *     @sk_callback_lock: used with the callbacks in the end of this struct
   *     @sk_error_queue: rarely used
   *     @sk_prot: protocol handlers inside a network family
+  *     @sk_prot_creator: sk_prot of original sock creator (see ipv6_setsockopt, IPV6_ADDRFORM for instance)
   *     @sk_err: last error
   *     @sk_err_soft: errors that don't cause failure but are the cause of a persistent failure not just 'timed out'
   *     @sk_ack_backlog: current listen backlog
@@ -218,6 +219,7 @@ struct sock {
         } sk_backlog;
         struct sk_buff_head     sk_error_queue;
         struct proto            *sk_prot;
+        struct proto            *sk_prot_creator;
         rwlock_t                sk_callback_lock;
         int                     sk_err,
                                 sk_err_soft;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9355ae5b1d75..e71f8ba3e101 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)tcp.h       1.0.5   05/23/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  *              This program is free software; you can redistribute it and/or
diff --git a/include/net/udp.h b/include/net/udp.h
index c496d10101db..ac229b761dbc 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)udp.h       1.0.2   05/07/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/include/scsi/scsi_transport_spi.h b/include/scsi/scsi_transport_spi.h
index 6dcf497bf46d..a30d6cd4c0e8 100644
--- a/include/scsi/scsi_transport_spi.h
+++ b/include/scsi/scsi_transport_spi.h
@@ -27,8 +27,11 @@ struct scsi_transport_template;
 
 struct spi_transport_attrs {
         int period;             /* value in the PPR/SDTR command */
+        int min_period;
         int offset;
+        int max_offset;
         unsigned int width:1;   /* 0 - narrow, 1 - wide */
+        unsigned int max_width:1;
         unsigned int iu:1;      /* Information Units enabled */
         unsigned int dt:1;      /* DT clocking enabled */
         unsigned int qas:1;     /* Quick Arbitration and Selection enabled */
@@ -63,8 +66,11 @@ struct spi_host_attrs {
 
 /* accessor functions */
 #define spi_period(x)   (((struct spi_transport_attrs *)&(x)->starget_data)->period)
+#define spi_min_period(x) (((struct spi_transport_attrs *)&(x)->starget_data)->min_period)
 #define spi_offset(x)   (((struct spi_transport_attrs *)&(x)->starget_data)->offset)
+#define spi_max_offset(x) (((struct spi_transport_attrs *)&(x)->starget_data)->max_offset)
 #define spi_width(x)    (((struct spi_transport_attrs *)&(x)->starget_data)->width)
+#define spi_max_width(x) (((struct spi_transport_attrs *)&(x)->starget_data)->max_width)
 #define spi_iu(x)       (((struct spi_transport_attrs *)&(x)->starget_data)->iu)
 #define spi_dt(x)       (((struct spi_transport_attrs *)&(x)->starget_data)->dt)
 #define spi_qas(x)      (((struct spi_transport_attrs *)&(x)->starget_data)->qas)
diff --git a/kernel/Makefile b/kernel/Makefile
index eb88b446c2cc..b01d26fe8db7 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -29,7 +29,7 @@ obj-$(CONFIG_SYSFS) += ksysfs.o
 obj-$(CONFIG_GENERIC_HARDIRQS) += irq/
 obj-$(CONFIG_SECCOMP) += seccomp.o
 
-ifneq ($(CONFIG_IA64),y)
+ifneq ($(CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER),y)
 # According to Alan Modra <alan@linuxcare.com.au>, the -fno-omit-frame-pointer is
 # needed for x86 only.  Why this used to be enabled for all architectures is beyond
 # me.  I suspect most platforms don't need this, but until we know that for sure
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 2fb0e46e11f3..06b5a6323998 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -30,6 +30,7 @@
  */
 irq_desc_t irq_desc[NR_IRQS] __cacheline_aligned = {
         [0 ... NR_IRQS-1] = {
+                .status = IRQ_DISABLED,
                 .handler = &no_irq_type,
                 .lock = SPIN_LOCK_UNLOCKED
         }
diff --git a/kernel/itimer.c b/kernel/itimer.c
index e9a40e947e07..1dc988e0d2c7 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -123,7 +123,11 @@ static inline void it_real_arm(struct task_struct *p, unsigned long interval)
                 return;
         if (interval > (unsigned long) LONG_MAX)
                 interval = LONG_MAX;
-        p->signal->real_timer.expires = jiffies + interval;
+        /* the "+ 1" below makes sure that the timer doesn't go off before
+         * the interval requested. This could happen if
+         * time requested % (usecs per jiffy) is more than the usecs left
+         * in the current jiffy */
+        p->signal->real_timer.expires = jiffies + interval + 1;
         add_timer(&p->signal->real_timer);
 }
 
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 1627f8d6e0cd..13bcec151b57 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -46,6 +46,14 @@ static inline int is_kernel_inittext(unsigned long addr)
         return 0;
 }
 
+static inline int is_kernel_extratext(unsigned long addr)
+{
+        if (addr >= (unsigned long)_sextratext
+            && addr <= (unsigned long)_eextratext)
+                return 1;
+        return 0;
+}
+
 static inline int is_kernel_text(unsigned long addr)
 {
         if (addr >= (unsigned long)_stext && addr <= (unsigned long)_etext)
@@ -169,8 +177,9 @@ const char *kallsyms_lookup(unsigned long addr,
         namebuf[0] = 0;
 
         if ((all_var && is_kernel(addr)) ||
-            (!all_var && (is_kernel_text(addr) || is_kernel_inittext(addr)))) {
-                unsigned long symbol_end=0;
+            (!all_var && (is_kernel_text(addr) || is_kernel_inittext(addr) ||
+                                is_kernel_extratext(addr)))) {
+                unsigned long symbol_end = 0;
 
                 /* do a binary search on the sorted kallsyms_addresses array */
                 low = 0;
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 1d5dd1337bd1..037142b72a49 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -44,6 +44,7 @@ static struct hlist_head kprobe_table[KPROBE_TABLE_SIZE];
 
 unsigned int kprobe_cpu = NR_CPUS;
 static DEFINE_SPINLOCK(kprobe_lock);
+static struct kprobe *curr_kprobe;
 
 /* Locks kprobe: irqs must be disabled */
 void lock_kprobes(void)
@@ -73,22 +74,139 @@ struct kprobe *get_kprobe(void *addr)
         return NULL;
 }
 
+/*
+ * Aggregate handlers for multiple kprobes support - these handlers
+ * take care of invoking the individual kprobe handlers on p->list
+ */
+int aggr_pre_handler(struct kprobe *p, struct pt_regs *regs)
+{
+        struct kprobe *kp;
+
+        list_for_each_entry(kp, &p->list, list) {
+                if (kp->pre_handler) {
+                        curr_kprobe = kp;
+                        kp->pre_handler(kp, regs);
+                        curr_kprobe = NULL;
+                }
+        }
+        return 0;
+}
+
+void aggr_post_handler(struct kprobe *p, struct pt_regs *regs,
+                unsigned long flags)
+{
+        struct kprobe *kp;
+
+        list_for_each_entry(kp, &p->list, list) {
+                if (kp->post_handler) {
+                        curr_kprobe = kp;
+                        kp->post_handler(kp, regs, flags);
+                        curr_kprobe = NULL;
+                }
+        }
+        return;
+}
+
+int aggr_fault_handler(struct kprobe *p, struct pt_regs *regs, int trapnr)
+{
+        /*
+         * if we faulted "during" the execution of a user specified
+         * probe handler, invoke just that probe's fault handler
+         */
+        if (curr_kprobe && curr_kprobe->fault_handler) {
+                if (curr_kprobe->fault_handler(curr_kprobe, regs, trapnr))
+                        return 1;
+        }
+        return 0;
+}
+
+/*
+ * Fill in the required fields of the "manager kprobe". Replace the
+ * earlier kprobe in the hlist with the manager kprobe
+ */
+static inline void add_aggr_kprobe(struct kprobe *ap, struct kprobe *p)
+{
+        ap->addr = p->addr;
+        ap->opcode = p->opcode;
+        memcpy(&ap->ainsn, &p->ainsn, sizeof(struct arch_specific_insn));
+
+        ap->pre_handler = aggr_pre_handler;
+        ap->post_handler = aggr_post_handler;
+        ap->fault_handler = aggr_fault_handler;
+
+        INIT_LIST_HEAD(&ap->list);
+        list_add(&p->list, &ap->list);
+
+        INIT_HLIST_NODE(&ap->hlist);
+        hlist_del(&p->hlist);
+        hlist_add_head(&ap->hlist,
+                &kprobe_table[hash_ptr(ap->addr, KPROBE_HASH_BITS)]);
+}
+
+/*
+ * This is the second or subsequent kprobe at the address - handle
+ * the intricacies
+ * TODO: Move kcalloc outside the spinlock
+ */
+static int register_aggr_kprobe(struct kprobe *old_p, struct kprobe *p)
+{
+        int ret = 0;
+        struct kprobe *ap;
+
+        if (old_p->break_handler || p->break_handler) {
+                ret = -EEXIST;  /* kprobe and jprobe can't (yet) coexist */
+        } else if (old_p->pre_handler == aggr_pre_handler) {
+                list_add(&p->list, &old_p->list);
+        } else {
+                ap = kcalloc(1, sizeof(struct kprobe), GFP_ATOMIC);
+                if (!ap)
+                        return -ENOMEM;
+                add_aggr_kprobe(ap, old_p);
+                list_add(&p->list, &ap->list);
+        }
+        return ret;
+}
+
+/* kprobe removal house-keeping routines */
+static inline void cleanup_kprobe(struct kprobe *p, unsigned long flags)
+{
+        *p->addr = p->opcode;
+        hlist_del(&p->hlist);
+        flush_icache_range((unsigned long) p->addr,
+                   (unsigned long) p->addr + sizeof(kprobe_opcode_t));
+        spin_unlock_irqrestore(&kprobe_lock, flags);
+        arch_remove_kprobe(p);
+}
+
+static inline void cleanup_aggr_kprobe(struct kprobe *old_p,
+                struct kprobe *p, unsigned long flags)
+{
+        list_del(&p->list);
+        if (list_empty(&old_p->list)) {
+                cleanup_kprobe(old_p, flags);
+                kfree(old_p);
+        } else
+                spin_unlock_irqrestore(&kprobe_lock, flags);
+}
+
 int register_kprobe(struct kprobe *p)
 {
         int ret = 0;
         unsigned long flags = 0;
+        struct kprobe *old_p;
 
         if ((ret = arch_prepare_kprobe(p)) != 0) {
                 goto rm_kprobe;
         }
         spin_lock_irqsave(&kprobe_lock, flags);
-        INIT_HLIST_NODE(&p->hlist);
-        if (get_kprobe(p->addr)) {
-                ret = -EEXIST;
+        old_p = get_kprobe(p->addr);
+        if (old_p) {
+                ret = register_aggr_kprobe(old_p, p);
                 goto out;
         }
-        arch_copy_kprobe(p);
 
+        arch_copy_kprobe(p);
+        INIT_HLIST_NODE(&p->hlist);
         hlist_add_head(&p->hlist,
                        &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
 
@@ -107,13 +225,17 @@ rm_kprobe:
 void unregister_kprobe(struct kprobe *p)
 {
         unsigned long flags;
-        arch_remove_kprobe(p);
+        struct kprobe *old_p;
+
         spin_lock_irqsave(&kprobe_lock, flags);
-        *p->addr = p->opcode;
-        hlist_del(&p->hlist);
-        flush_icache_range((unsigned long) p->addr,
-                           (unsigned long) p->addr + sizeof(kprobe_opcode_t));
-        spin_unlock_irqrestore(&kprobe_lock, flags);
+        old_p = get_kprobe(p->addr);
+        if (old_p) {
+                if (old_p->pre_handler == aggr_pre_handler)
+                        cleanup_aggr_kprobe(old_p, p, flags);
+                else
+                        cleanup_kprobe(p, flags);
+        } else
+                spin_unlock_irqrestore(&kprobe_lock, flags);
 }
 
 static struct notifier_block kprobe_exceptions_nb = {
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 7960ddf04a57..4cdebc972ff2 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -156,14 +156,14 @@ static int enter_state(suspend_state_t state)
                 goto Unlock;
         }
 
-        pr_debug("PM: Preparing system for suspend\n");
+        pr_debug("PM: Preparing system for %s sleep\n", pm_states[state]);
         if ((error = suspend_prepare(state)))
                 goto Unlock;
 
-        pr_debug("PM: Entering state.\n");
+        pr_debug("PM: Entering %s sleep\n", pm_states[state]);
         error = suspend_enter(state);
 
-        pr_debug("PM: Finishing up.\n");
+        pr_debug("PM: Finishing wakeup.\n");
         suspend_finish(state);
  Unlock:
         up(&pm_sem);
diff --git a/kernel/printk.c b/kernel/printk.c
index 290a07ce2c8a..01b58d7d17ff 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -160,42 +160,6 @@ static int __init console_setup(char *str)
 
 __setup("console=", console_setup);
 
-/**
- * add_preferred_console - add a device to the list of preferred consoles.
- *
- * The last preferred console added will be used for kernel messages
- * and stdin/out/err for init.  Normally this is used by console_setup
- * above to handle user-supplied console arguments; however it can also
- * be used by arch-specific code either to override the user or more
- * commonly to provide a default console (ie from PROM variables) when
- * the user has not supplied one.
- */
-int __init add_preferred_console(char *name, int idx, char *options)
-{
-        struct console_cmdline *c;
-        int i;
-
-        /*
-         *      See if this tty is not yet registered, and
-         *      if we have a slot free.
-         */
-        for(i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
-                if (strcmp(console_cmdline[i].name, name) == 0 &&
-                          console_cmdline[i].index == idx) {
-                                selected_console = i;
-                                return 0;
-                }
-        if (i == MAX_CMDLINECONSOLES)
-                return -E2BIG;
-        selected_console = i;
-        c = &console_cmdline[i];
-        memcpy(c->name, name, sizeof(c->name));
-        c->name[sizeof(c->name) - 1] = 0;
-        c->options = options;
-        c->index = idx;
-        return 0;
-}
-
 static int __init log_buf_len_setup(char *str)
 {
         unsigned long size = memparse(str, &str);
@@ -671,6 +635,42 @@ static void call_console_drivers(unsigned long start, unsigned long end) {}
 #endif
 
 /**
+ * add_preferred_console - add a device to the list of preferred consoles.
+ *
+ * The last preferred console added will be used for kernel messages
+ * and stdin/out/err for init.  Normally this is used by console_setup
+ * above to handle user-supplied console arguments; however it can also
+ * be used by arch-specific code either to override the user or more
+ * commonly to provide a default console (ie from PROM variables) when
+ * the user has not supplied one.
+ */
+int __init add_preferred_console(char *name, int idx, char *options)
+{
+        struct console_cmdline *c;
+        int i;
+
+        /*
+         *      See if this tty is not yet registered, and
+         *      if we have a slot free.
+         */
+        for(i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0]; i++)
+                if (strcmp(console_cmdline[i].name, name) == 0 &&
+                          console_cmdline[i].index == idx) {
+                                selected_console = i;
+                                return 0;
+                }
+        if (i == MAX_CMDLINECONSOLES)
+                return -E2BIG;
+        selected_console = i;
+        c = &console_cmdline[i];
+        memcpy(c->name, name, sizeof(c->name));
+        c->name[sizeof(c->name) - 1] = 0;
+        c->options = options;
+        c->index = idx;
+        return 0;
+}
+
+/**
  * acquire_console_sem - lock the console system for exclusive use.
  *
  * Acquires a semaphore which guarantees that the caller has
diff --git a/kernel/profile.c b/kernel/profile.c
index 0221a50ca867..ad8cbb75ffa2 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -49,15 +49,19 @@ static DECLARE_MUTEX(profile_flip_mutex);
 
 static int __init profile_setup(char * str)
 {
+        static char __initdata schedstr[] = "schedule";
         int par;
 
-        if (!strncmp(str, "schedule", 8)) {
+        if (!strncmp(str, schedstr, strlen(schedstr))) {
                 prof_on = SCHED_PROFILING;
-                printk(KERN_INFO "kernel schedule profiling enabled\n");
-                if (str[7] == ',')
-                        str += 8;
-        }
-        if (get_option(&str,&par)) {
+                if (str[strlen(schedstr)] == ',')
+                        str += strlen(schedstr) + 1;
+                if (get_option(&str, &par))
+                        prof_shift = par;
+                printk(KERN_INFO
+                        "kernel schedule profiling enabled (shift: %ld)\n",
+                        prof_shift);
+        } else if (get_option(&str, &par)) {
                 prof_shift = par;
                 prof_on = CPU_PROFILING;
                 printk(KERN_INFO "kernel profiling enabled (shift: %ld)\n",
diff --git a/kernel/sched.c b/kernel/sched.c
index 0dc3158667a2..66b2ed784822 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4243,7 +4243,7 @@ static void move_task_off_dead_cpu(int dead_cpu, struct task_struct *tsk)
 
         /* No more Mr. Nice Guy. */
         if (dest_cpu == NR_CPUS) {
-                tsk->cpus_allowed = cpuset_cpus_allowed(tsk);
+                cpus_setall(tsk->cpus_allowed);
                 dest_cpu = any_online_cpu(tsk->cpus_allowed);
 
                 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index f64e97cabe25..f006632c2ba7 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1195,7 +1195,7 @@ static int groups_from_user(struct group_info *group_info,
         return 0;
 }
 
-/* a simple shell-metzner sort */
+/* a simple Shell sort */
 static void groups_sort(struct group_info *group_info)
 {
         int base, max, stride;
diff --git a/lib/sort.c b/lib/sort.c
index ea3caedeabdb..b73dbb0e7c83 100644
--- a/lib/sort.c
+++ b/lib/sort.c
@@ -90,7 +90,7 @@ int cmpint(const void *a, const void *b)
 
 static int sort_test(void)
 {
-        int *a, i, r = 0;
+        int *a, i, r = 1;
 
         a = kmalloc(1000 * sizeof(int), GFP_KERNEL);
         BUG_ON(!a);
diff --git a/lib/string.c b/lib/string.c
index 4bb93ad23c60..d886ef157c12 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -65,6 +65,7 @@ EXPORT_SYMBOL(strnicmp);
  * @dest: Where to copy the string to
  * @src: Where to copy the string from
  */
+#undef strcpy
 char * strcpy(char * dest,const char *src)
 {
         char *tmp = dest;
@@ -85,6 +86,10 @@ EXPORT_SYMBOL(strcpy);
  *
  * The result is not %NUL-terminated if the source exceeds
  * @count bytes.
+ *
+ * In the case where the length of @src is less than  that  of
+ * count, the remainder of @dest will be padded with %NUL.
+ *
  */
 char * strncpy(char * dest,const char *src,size_t count)
 {
@@ -132,6 +137,7 @@ EXPORT_SYMBOL(strlcpy);
  * @dest: The string to be appended to
  * @src: The string to append to it
  */
+#undef strcat
 char * strcat(char * dest, const char * src)
 {
         char *tmp = dest;
@@ -209,6 +215,7 @@ EXPORT_SYMBOL(strlcat);
  * @cs: One string
  * @ct: Another string
  */
+#undef strcmp
 int strcmp(const char * cs,const char * ct)
 {
         register signed char __res;
@@ -514,6 +521,7 @@ EXPORT_SYMBOL(memmove);
  * @ct: Another area of memory
  * @count: The size of the area.
  */
+#undef memcmp
 int memcmp(const void * cs,const void * ct,size_t count)
 {
         const unsigned char *su1, *su2;
diff --git a/mm/filemap.c b/mm/filemap.c
index d5fdae2eb183..47263ac3e4ea 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -29,11 +29,6 @@
 #include <linux/security.h>
 #include <linux/syscalls.h>
 /*
- * This is needed for the following functions:
- *  - try_to_release_page
- *  - block_invalidatepage
- *  - generic_osync_inode
- *
  * FIXME: remove all knowledge of the buffer layer from the core VM
  */
 #include <linux/buffer_head.h> /* for generic_osync_inode */
diff --git a/mm/memory.c b/mm/memory.c
index 6bad4c4064e7..d209f745db7f 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1701,12 +1701,13 @@ static int do_swap_page(struct mm_struct * mm,
         spin_lock(&mm->page_table_lock);
         page_table = pte_offset_map(pmd, address);
         if (unlikely(!pte_same(*page_table, orig_pte))) {
-                pte_unmap(page_table);
-                spin_unlock(&mm->page_table_lock);
-                unlock_page(page);
-                page_cache_release(page);
                 ret = VM_FAULT_MINOR;
-                goto out;
+                goto out_nomap;
+        }
+
+        if (unlikely(!PageUptodate(page))) {
+                ret = VM_FAULT_SIGBUS;
+                goto out_nomap;
         }
 
         /* The page isn't present yet, go ahead with the fault. */
@@ -1741,6 +1742,12 @@ static int do_swap_page(struct mm_struct * mm,
         spin_unlock(&mm->page_table_lock);
 out:
         return ret;
+out_nomap:
+        pte_unmap(page_table);
+        spin_unlock(&mm->page_table_lock);
+        unlock_page(page);
+        page_cache_release(page);
+        goto out;
 }
 
 /*
diff --git a/mm/mmap.c b/mm/mmap.c
index 01f9793591f6..de54acd9942f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1244,7 +1244,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
         addr = mm->free_area_cache;
 
         /* make sure it can fit in the remaining address space */
-        if (addr >= len) {
+        if (addr > len) {
                 vma = find_vma(mm, addr-len);
                 if (!vma || addr <= vma->vm_start)
                         /* remember the address as a hint for next time */
@@ -1266,7 +1266,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
                 /* try just below the current vma->vm_start */
                 addr = vma->vm_start-len;
-        } while (len <= vma->vm_start);
+        } while (len < vma->vm_start);
 
         /*
          * A failed mmap() very likely causes application failure,
@@ -1302,37 +1302,40 @@ unsigned long
 get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
                 unsigned long pgoff, unsigned long flags)
 {
-        if (flags & MAP_FIXED) {
-                unsigned long ret;
+        unsigned long ret;
 
-                if (addr > TASK_SIZE - len)
-                        return -ENOMEM;
-                if (addr & ~PAGE_MASK)
-                        return -EINVAL;
-                if (file && is_file_hugepages(file))  {
-                        /*
-                         * Check if the given range is hugepage aligned, and
-                         * can be made suitable for hugepages.
-                         */
-                        ret = prepare_hugepage_range(addr, len);
-                } else {
-                        /*
-                         * Ensure that a normal request is not falling in a
-                         * reserved hugepage range.  For some archs like IA-64,
-                         * there is a separate region for hugepages.
-                         */
-                        ret = is_hugepage_only_range(current->mm, addr, len);
-                }
-                if (ret)
-                        return -EINVAL;
-                return addr;
-        }
+        if (!(flags & MAP_FIXED)) {
+                unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
-        if (file && file->f_op && file->f_op->get_unmapped_area)
-                return file->f_op->get_unmapped_area(file, addr, len,
-                                                pgoff, flags);
+                get_area = current->mm->get_unmapped_area;
+                if (file && file->f_op && file->f_op->get_unmapped_area)
+                        get_area = file->f_op->get_unmapped_area;
+                addr = get_area(file, addr, len, pgoff, flags);
+                if (IS_ERR_VALUE(addr))
+                        return addr;
+        }
 
-        return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+        if (addr > TASK_SIZE - len)
+                return -ENOMEM;
+        if (addr & ~PAGE_MASK)
+                return -EINVAL;
+        if (file && is_file_hugepages(file))  {
+                /*
+                 * Check if the given range is hugepage aligned, and
+                 * can be made suitable for hugepages.
+                 */
+                ret = prepare_hugepage_range(addr, len);
+        } else {
+                /*
+                 * Ensure that a normal request is not falling in a
+                 * reserved hugepage range.  For some archs like IA-64,
+                 * there is a separate region for hugepages.
+                 */
+                ret = is_hugepage_only_range(current->mm, addr, len);
+        }
+        if (ret)
+                return -EINVAL;
+        return addr;
 }
 
 EXPORT_SYMBOL(get_unmapped_area);
diff --git a/mm/mremap.c b/mm/mremap.c
index 0dd7ace94e51..ec7238a78f36 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -224,6 +224,12 @@ static unsigned long move_vma(struct vm_area_struct *vma,
                         split = 1;
         }
 
+        /*
+         * if we failed to move page tables we still do total_vm increment
+         * since do_munmap() will decrement it by old_len == new_len
+         */
+        mm->total_vm += new_len >> PAGE_SHIFT;
+
         if (do_munmap(mm, old_addr, old_len) < 0) {
                 /* OOM: unable to split vma, just get accounts right */
                 vm_unacct_memory(excess >> PAGE_SHIFT);
@@ -237,7 +243,6 @@ static unsigned long move_vma(struct vm_area_struct *vma,
                         vma->vm_next->vm_flags |= VM_ACCOUNT;
         }
 
-        mm->total_vm += new_len >> PAGE_SHIFT;
         __vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {
                 mm->locked_vm += new_len >> PAGE_SHIFT;
diff --git a/mm/nommu.c b/mm/nommu.c
index b293ec1cc4e6..c53e9c8f6b4a 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -150,7 +150,8 @@ void vfree(void *addr)
         kfree(addr);
 }
 
-void *__vmalloc(unsigned long size, int gfp_mask, pgprot_t prot)
+void *__vmalloc(unsigned long size, unsigned int __nocast gfp_mask,
+                        pgprot_t prot)
 {
         /*
          * kmalloc doesn't like __GFP_HIGHMEM for some reason
diff --git a/mm/rmap.c b/mm/rmap.c
index 378de234c12b..a6203b4e1278 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -586,7 +586,7 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma)
                 dec_mm_counter(mm, anon_rss);
         }
 
-        inc_mm_counter(mm, rss);
+        dec_mm_counter(mm, rss);
         page_remove_rmap(page);
         page_cache_release(page);
 
diff --git a/mm/swapfile.c b/mm/swapfile.c
index a60e0075d55b..da48405cd9a3 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -79,7 +79,7 @@ void swap_unplug_io_fn(struct backing_dev_info *unused_bdi, struct page *page)
                 WARN_ON(page_count(page) <= 1);
 
                 bdi = bdev->bd_inode->i_mapping->backing_dev_info;
-                bdi->unplug_io_fn(bdi, page);
+                blk_run_backing_dev(bdi, page);
         }
         up_read(&swap_unplug_sem);
 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 2bd83e5c2bbf..8ff16a1eee6a 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -248,31 +248,20 @@ struct vm_struct *get_vm_area(unsigned long size, unsigned long flags)
         return __get_vm_area(size, flags, VMALLOC_START, VMALLOC_END);
 }
 
-/**
- *      remove_vm_area  -  find and remove a contingous kernel virtual area
- *
- *      @addr:          base address
- *
- *      Search for the kernel VM area starting at @addr, and remove it.
- *      This function returns the found VM area, but using it is NOT safe
- *      on SMP machines.
- */
-struct vm_struct *remove_vm_area(void *addr)
+/* Caller must hold vmlist_lock */
+struct vm_struct *__remove_vm_area(void *addr)
 {
         struct vm_struct **p, *tmp;
 
-        write_lock(&vmlist_lock);
         for (p = &vmlist ; (tmp = *p) != NULL ;p = &tmp->next) {
                  if (tmp->addr == addr)
                          goto found;
         }
-        write_unlock(&vmlist_lock);
         return NULL;
 
 found:
         unmap_vm_area(tmp);
         *p = tmp->next;
-        write_unlock(&vmlist_lock);
 
         /*
          * Remove the guard page.
@@ -281,6 +270,24 @@ found:
         return tmp;
 }
 
+/**
+ *      remove_vm_area  -  find and remove a contingous kernel virtual area
+ *
+ *      @addr:          base address
+ *
+ *      Search for the kernel VM area starting at @addr, and remove it.
+ *      This function returns the found VM area, but using it is NOT safe
+ *      on SMP machines, except for its size or flags.
+ */
+struct vm_struct *remove_vm_area(void *addr)
+{
+        struct vm_struct *v;
+        write_lock(&vmlist_lock);
+        v = __remove_vm_area(addr);
+        write_unlock(&vmlist_lock);
+        return v;
+}
+
 void __vunmap(void *addr, int deallocate_pages)
 {
         struct vm_struct *area;
diff --git a/net/802/fddi.c b/net/802/fddi.c
index f9a31a9f70f1..ebcf4830d6f1 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -10,7 +10,7 @@
  * Authors:     Lawrence V. Stefani, <stefani@lkg.dec.com>
  *
  *              fddi.c is based on previous eth.c and tr.c work by
- *                      Ross Biro, <bir7@leland.Stanford.Edu>
+ *                      Ross Biro
  *                      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                      Mark Evans, <evansmp@uhura.aston.ac.uk>
  *                      Florian La Roche, <rzsfl@rz.uni-sb.de>
diff --git a/net/802/hippi.c b/net/802/hippi.c
index 4eb135c0afbb..051e8af56a77 100644
--- a/net/802/hippi.c
+++ b/net/802/hippi.c
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)hippi.c     1.0.0   05/29/97
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Florian  La Roche, <rzsfl@rz.uni-sb.de>
diff --git a/net/appletalk/dev.c b/net/appletalk/dev.c
index 76598445d84b..1237e208e246 100644
--- a/net/appletalk/dev.c
+++ b/net/appletalk/dev.c
@@ -19,7 +19,7 @@ static int ltalk_mac_addr(struct net_device *dev, void *addr)
         return -EINVAL;
 }
 
-void ltalk_setup(struct net_device *dev)
+static void ltalk_setup(struct net_device *dev)
 {
         /* Fill in the fields of the device structure with localtalk-generic values. */
         
@@ -40,4 +40,22 @@ void ltalk_setup(struct net_device *dev)
 
         dev->flags              = IFF_BROADCAST|IFF_MULTICAST|IFF_NOARP;
 }
-EXPORT_SYMBOL(ltalk_setup);
+
+/**
+ * alloc_ltalkdev - Allocates and sets up an localtalk device
+ * @sizeof_priv: Size of additional driver-private structure to be allocated
+ *      for this localtalk device
+ *
+ * Fill in the fields of the device structure with localtalk-generic
+ * values. Basically does everything except registering the device.
+ *
+ * Constructs a new net device, complete with a private data area of
+ * size @sizeof_priv.  A 32-byte (not bit) alignment is enforced for
+ * this private data area.
+ */
+
+struct net_device *alloc_ltalkdev(int sizeof_priv)
+{
+        return alloc_netdev(sizeof_priv, "lt%d", ltalk_setup);
+}
+EXPORT_SYMBOL(alloc_ltalkdev);
diff --git a/net/core/dev.c b/net/core/dev.c
index f5f005846fe1..d4d9e2680adb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7,7 +7,7 @@
  *              2 of the License, or (at your option) any later version.
  *
  *      Derived from the non IP parts of dev.c 1.0.19
- *              Authors:        Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Authors:        Ross Biro
  *                              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *
diff --git a/net/core/sock.c b/net/core/sock.c
index 98171ddd7e7d..96e00b08698f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -9,7 +9,7 @@
  *
  * Version:     $Id: sock.c,v 1.117 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Florian La Roche, <flla@stud.uni-sb.de>
  *              Alan Cox, <A.Cox@swansea.ac.uk>
@@ -635,7 +635,11 @@ struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
                 if (zero_it) {
                         memset(sk, 0, prot->obj_size);
                         sk->sk_family = family;
-                        sk->sk_prot = prot;
+                        /*
+                         * See comment in struct sock definition to understand
+                         * why we need sk_prot_creator -acme
+                         */
+                        sk->sk_prot = sk->sk_prot_creator = prot;
                         sock_lock_init(sk);
                 }
                 
@@ -654,7 +658,7 @@ struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
 void sk_free(struct sock *sk)
 {
         struct sk_filter *filter;
-        struct module *owner = sk->sk_prot->owner;
+        struct module *owner = sk->sk_prot_creator->owner;
 
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
@@ -672,8 +676,8 @@ void sk_free(struct sock *sk)
                        __FUNCTION__, atomic_read(&sk->sk_omem_alloc));
 
         security_sk_free(sk);
-        if (sk->sk_prot->slab != NULL)
-                kmem_cache_free(sk->sk_prot->slab, sk);
+        if (sk->sk_prot_creator->slab != NULL)
+                kmem_cache_free(sk->sk_prot_creator->slab, sk);
         else
                 kfree(sk);
         module_put(owner);
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index e6e23eb14428..ee7bf46eb78a 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1426,7 +1426,7 @@ static struct rtnetlink_link dnet_rtnetlink_table[RTM_NR_MSGTYPES] =
         [RTM_GETRULE  - RTM_BASE] = { .dumpit   = dn_fib_dump_rules,    },
 #else
         [RTM_GETROUTE - RTM_BASE] = { .doit     = dn_cache_getroute,
-                                      .dumpit   = dn_cache_dump,        
+                                      .dumpit   = dn_cache_dump,        },
 #endif
 
 };
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 16c4234cbe12..6617ea47d365 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)eth.c       1.0.7   05/25/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Florian  La Roche, <rzsfl@rz.uni-sb.de>
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index cdad47642ae7..b3cb49ce5fad 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: af_inet.c,v 1.137 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Florian La Roche, <flla@stud.uni-sb.de>
  *              Alan Cox, <A.Cox@swansea.ac.uk>
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index abbc6d5c183e..3cc96730c4ed 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -9,7 +9,7 @@
  *              2 of the License, or (at your option) any later version.
  *
  *      Derived from the IP parts of dev.c 1.0.19
- *              Authors:        Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Authors:        Ross Biro
  *                              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index a0d0833034be..4e47a2658c7c 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: ip_input.c,v 1.55 2002/01/12 07:39:45 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Donald Becker, <becker@super.org>
  *              Alan Cox, <Alan.Cox@linux.org>
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 24fe3e00b42b..760dc8238d65 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: ip_output.c,v 1.100 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Donald Becker, <becker@super.org>
  *              Alan Cox, <Alan.Cox@linux.org>
@@ -490,6 +490,14 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 /* Everything is OK. Generate! */
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index faa6176bbeb1..de21da00057f 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -508,7 +508,6 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                         rc = NF_ACCEPT;
                 /* do not touch skb anymore */
                 atomic_inc(&cp->in_pkts);
-                __ip_vs_conn_put(cp);
                 goto out;
         }
 
diff --git a/net/ipv4/multipath_wrandom.c b/net/ipv4/multipath_wrandom.c
index 10b23e1bece6..c3d2ca1a6781 100644
--- a/net/ipv4/multipath_wrandom.c
+++ b/net/ipv4/multipath_wrandom.c
@@ -172,7 +172,7 @@ static void wrandom_select_route(const struct flowi *flp,
                     multipath_comparekeys(&rt->fl, flp)) {
                         struct multipath_candidate* mpc =
                                 (struct multipath_candidate*)
-                                kmalloc(size_mpc, GFP_KERNEL);
+                                kmalloc(size_mpc, GFP_ATOMIC);
 
                         if (!mpc)
                                 return;
@@ -244,7 +244,7 @@ static void wrandom_set_nhinfo(__u32 network,
         if (!target_route) {
                 const size_t size_rt = sizeof(struct multipath_route);
                 target_route = (struct multipath_route *)
-                        kmalloc(size_rt, GFP_KERNEL);
+                        kmalloc(size_rt, GFP_ATOMIC);
 
                 target_route->gw = nh->nh_gw;
                 target_route->oif = nh->nh_oif;
@@ -265,7 +265,7 @@ static void wrandom_set_nhinfo(__u32 network,
         if (!target_dest) {
                 const size_t size_dst = sizeof(struct multipath_dest);
                 target_dest = (struct multipath_dest*)
-                        kmalloc(size_dst, GFP_KERNEL);
+                        kmalloc(size_dst, GFP_ATOMIC);
 
                 target_dest->nh_info = nh;
                 target_dest->network = network;
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 28d9425d5c39..09e824622977 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -940,37 +940,25 @@ void ip_ct_refresh_acct(struct ip_conntrack *ct,
 struct sk_buff *
 ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
-        struct sock *sk = skb->sk;
 #ifdef CONFIG_NETFILTER_DEBUG
         unsigned int olddebug = skb->nf_debug;
 #endif
 
-        if (sk) {
-                sock_hold(sk);
-                skb_orphan(skb);
-        }
+        skb_orphan(skb);
 
         local_bh_disable(); 
         skb = ip_defrag(skb, user);
         local_bh_enable();
 
-        if (!skb) {
-                if (sk)
-                        sock_put(sk);
-                return skb;
-        }
-
-        if (sk) {
-                skb_set_owner_w(skb, sk);
-                sock_put(sk);
-        }
-
-        ip_send_check(skb->nh.iph);
-        skb->nfcache |= NFC_ALTERED;
+        if (skb) {
+                ip_send_check(skb->nh.iph);
+                skb->nfcache |= NFC_ALTERED;
 #ifdef CONFIG_NETFILTER_DEBUG
-        /* Packet path as if nothing had happened. */
-        skb->nf_debug = olddebug;
+                /* Packet path as if nothing had happened. */
+                skb->nf_debug = olddebug;
 #endif
+        }
+
         return skb;
 }
 
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index 90a587cacaa4..0db405a869f2 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: protocol.c,v 1.14 2001/05/18 02:25:49 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 93624a32eb9a..5b1ec586bae6 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: raw.c,v 1.64 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 199311746932..a682d28e247b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: route.c,v 1.103 2002/01/12 07:44:09 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  *              Linus Torvalds, <Linus.Torvalds@helsinki.fi>
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5cff56af7855..a037bafcba3c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp.c,v 1.216 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6984042c0927..79835a67a274 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_input.c,v 1.243 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index fd70509f0d53..eea1a17a9ac2 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_minisocks.c,v 1.15 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a12df6979ffd..fa24e7ae1f40 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_output.c,v 1.146 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 85b279f1e935..799ebe061e2c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_timer.c,v 1.88 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 8a213238f287..4a6952e3fee9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: udp.c,v 1.102 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  *              Alan Cox, <Alan.Cox@linux.org>
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0f0711417c9d..b78a53586804 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -552,13 +552,17 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                             skb_headroom(frag) < hlen)
                             goto slow_path;
 
-                        /* Correct socket ownership. */
-                        if (frag->sk == NULL)
-                                goto slow_path;
-
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 err = 0;
@@ -1116,12 +1120,10 @@ int ip6_push_pending_frames(struct sock *sk)
                 tail_skb = &(tmp_skb->next);
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
-#if 0 /* Logically correct, but useless work, ip_fragment() will have to undo */
                 skb->truesize += tmp_skb->truesize;
                 __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
-#endif
         }
 
         ipv6_addr_copy(final_dst, &fl->fl6_dst);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 733bf52cef3e..e41ce458c2a9 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -735,11 +735,15 @@ static inline int do_one_broadcast(struct sock *sk,
 
         sock_hold(sk);
         if (p->skb2 == NULL) {
-                if (atomic_read(&p->skb->users) != 1) {
+                if (skb_shared(p->skb)) {
                         p->skb2 = skb_clone(p->skb, p->allocation);
                 } else {
-                        p->skb2 = p->skb;
-                        atomic_inc(&p->skb->users);
+                        p->skb2 = skb_get(p->skb);
+                        /*
+                         * skb ownership may have been set when
+                         * delivered to a previous socket.
+                         */
+                        skb_orphan(p->skb2);
                 }
         }
         if (p->skb2 == NULL) {
@@ -785,11 +789,12 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid,
         sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
                 do_one_broadcast(sk, &info);
 
+        kfree_skb(skb);
+
         netlink_unlock_table();
 
         if (info.skb2)
                 kfree_skb(info.skb2);
-        kfree_skb(skb);
 
         if (info.delivered) {
                 if (info.congested && (allocation & __GFP_WAIT))
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 64acea0adaae..0269616e75a1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  *
diff --git a/net/socket.c b/net/socket.c
index 2cd44990d8d3..cec0cb38b9ce 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -4,7 +4,7 @@
  * Version:     @(#)socket.c    1.1.93  18/02/95
  *
  * Authors:     Orest Zborowski, <obz@Kodak.COM>
- *              Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c478fc8db776..c420eba4876b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -770,33 +770,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 err = path_lookup(sunaddr->sun_path, LOOKUP_PARENT, &nd);
                 if (err)
                         goto out_mknod_parent;
-                /*
-                 * Yucky last component or no last component at all?
-                 * (foo/., foo/.., /////)
-                 */
-                err = -EEXIST;
-                if (nd.last_type != LAST_NORM)
-                        goto out_mknod;
-                /*
-                 * Lock the directory.
-                 */
-                down(&nd.dentry->d_inode->i_sem);
-                /*
-                 * Do the final lookup.
-                 */
-                dentry = lookup_hash(&nd.last, nd.dentry);
+
+                dentry = lookup_create(&nd, 0);
                 err = PTR_ERR(dentry);
                 if (IS_ERR(dentry))
                         goto out_mknod_unlock;
-                err = -ENOENT;
-                /*
-                 * Special case - lookup gave negative, but... we had foo/bar/
-                 * From the vfs_mknod() POV we just have a negative dentry -
-                 * all is fine. Let's be bastards - you had / on the end, you've
-                 * been asking for (non-existent) directory. -ENOENT for you.
-                 */
-                if (nd.last.name[nd.last.len] && !dentry->d_inode)
-                        goto out_mknod_dput;
+
                 /*
                  * All right, let's create it.
                  */
@@ -845,7 +824,6 @@ out_mknod_dput:
         dput(dentry);
 out_mknod_unlock:
         up(&nd.dentry->d_inode->i_sem);
-out_mknod:
         path_release(&nd);
 out_mknod_parent:
         if (err==-EEXIST)
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 080aae243ce0..2f4531fcaca2 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -698,7 +698,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
                                 return -ENOMEM;
 
                         if (skb1->sk)
-                                skb_set_owner_w(skb, skb1->sk);
+                                skb_set_owner_w(skb2, skb1->sk);
 
                         /* Looking around. Are we still alive?
                          * OK, link new skb, drop old one */
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5ddda2c98af9..97509011c274 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -34,14 +34,21 @@ static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
 {
         struct rtattr *rt = xfrma[type - 1];
         struct xfrm_algo *algp;
+        int len;
 
         if (!rt)
                 return 0;
 
-        if ((rt->rta_len - sizeof(*rt)) < sizeof(*algp))
+        len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp);
+        if (len < 0)
                 return -EINVAL;
 
         algp = RTA_DATA(rt);
+
+        len -= (algp->alg_key_len + 7U) / 8; 
+        if (len < 0)
+                return -EINVAL;
+
         switch (type) {
         case XFRMA_ALG_AUTH:
                 if (!algp->alg_key_len &&
@@ -162,6 +169,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
         struct rtattr *rta = u_arg;
         struct xfrm_algo *p, *ualg;
         struct xfrm_algo_desc *algo;
+        int len;
 
         if (!rta)
                 return 0;
@@ -173,11 +181,12 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
                 return -ENOSYS;
         *props = algo->desc.sadb_alg_id;
 
-        p = kmalloc(sizeof(*ualg) + ualg->alg_key_len, GFP_KERNEL);
+        len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8;
+        p = kmalloc(len, GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
-        memcpy(p, ualg, sizeof(*ualg) + ualg->alg_key_len);
+        memcpy(p, ualg, len);
         *algpp = p;
         return 0;
 }
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index fe11df83d1fc..d3d2e5341051 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -67,7 +67,7 @@ struct sym_entry {
 
 static struct sym_entry *table;
 static int size, cnt;
-static unsigned long long _stext, _etext, _sinittext, _einittext;
+static unsigned long long _stext, _etext, _sinittext, _einittext, _sextratext, _eextratext;
 static int all_symbols = 0;
 static char symbol_prefix_char = '\0';
 
@@ -139,6 +139,10 @@ read_symbol(FILE *in, struct sym_entry *s)
                 _sinittext = s->addr;
         else if (strcmp(sym, "_einittext") == 0)
                 _einittext = s->addr;
+        else if (strcmp(sym, "_sextratext") == 0)
+                _sextratext = s->addr;
+        else if (strcmp(sym, "_eextratext") == 0)
+                _eextratext = s->addr;
         else if (toupper(s->type) == 'A')
         {
                 /* Keep these useful absolute symbols */
@@ -194,16 +198,18 @@ symbol_valid(struct sym_entry *s)
          * and inittext sections are discarded */
         if (!all_symbols) {
                 if ((s->addr < _stext || s->addr > _etext)
-                    && (s->addr < _sinittext || s->addr > _einittext))
+                    && (s->addr < _sinittext || s->addr > _einittext)
+                    && (s->addr < _sextratext || s->addr > _eextratext))
                         return 0;
                 /* Corner case.  Discard any symbols with the same value as
-                 * _etext or _einittext, they can move between pass 1 and 2
-                 * when the kallsyms data is added.  If these symbols move then
-                 * they may get dropped in pass 2, which breaks the kallsyms
-                 * rules.
+                 * _etext _einittext or _eextratext; they can move between pass
+                 * 1 and 2 when the kallsyms data are added.  If these symbols
+                 * move then they may get dropped in pass 2, which breaks the
+                 * kallsyms rules.
                  */
                 if ((s->addr == _etext && strcmp(s->sym + offset, "_etext")) ||
-                    (s->addr == _einittext && strcmp(s->sym + offset, "_einittext")))
+                    (s->addr == _einittext && strcmp(s->sym + offset, "_einittext")) ||
+                    (s->addr == _eextratext && strcmp(s->sym + offset, "_eextratext")))
                         return 0;
         }
 
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 5a5ddc40f36c..09abb891d11f 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -2,7 +2,7 @@
 # Kernel configuration targets
 # These targets are used from top-level makefile
 
-.PHONY: oldconfig xconfig gconfig menuconfig config silentoldconfig
+.PHONY: oldconfig xconfig gconfig menuconfig config silentoldconfig update-po-config
 
 xconfig: $(obj)/qconf
         $< arch/$(ARCH)/Kconfig
@@ -23,6 +23,13 @@ oldconfig: $(obj)/conf
 silentoldconfig: $(obj)/conf
         $< -s arch/$(ARCH)/Kconfig
 
+update-po-config: $(obj)/kxgettext
+        xgettext --default-domain=linux \
+          --add-comments --keyword=_ --keyword=N_ \
+          --files-from=scripts/kconfig/POTFILES.in \
+        -o scripts/kconfig/linux.pot
+        scripts/kconfig/kxgettext arch/$(ARCH)/Kconfig >> scripts/kconfig/linux.pot
+
 .PHONY: randconfig allyesconfig allnoconfig allmodconfig defconfig
 
 randconfig: $(obj)/conf
@@ -72,9 +79,10 @@ help:
 #         Based on GTK which needs to be installed to compile it
 # object files used by all kconfig flavours
 
-hostprogs-y     := conf mconf qconf gconf
+hostprogs-y     := conf mconf qconf gconf kxgettext
 conf-objs       := conf.o  zconf.tab.o
 mconf-objs      := mconf.o zconf.tab.o
+kxgettext-objs  := kxgettext.o zconf.tab.o
 
 ifeq ($(MAKECMDGOALS),xconfig)
         qconf-target := 1
@@ -107,7 +115,7 @@ HOSTLOADLIBES_gconf	= `pkg-config gtk+-2.0 gmodule-2.0 libglade-2.0 --libs`
 HOSTCFLAGS_gconf.o      = `pkg-config gtk+-2.0 gmodule-2.0 libglade-2.0 --cflags` \
                           -D LKC_DIRECT_LINK
 
-$(obj)/conf.o $(obj)/mconf.o $(obj)/qconf.o $(obj)/gconf.o: $(obj)/zconf.tab.h
+$(obj)/conf.o $(obj)/mconf.o $(obj)/qconf.o $(obj)/gconf.o $(obj)/kxgettext: $(obj)/zconf.tab.h
 
 $(obj)/zconf.tab.h: $(src)/zconf.tab.h_shipped
 $(obj)/zconf.tab.c: $(src)/zconf.tab.c_shipped
diff --git a/scripts/kconfig/POTFILES.in b/scripts/kconfig/POTFILES.in
new file mode 100644
index 000000000000..cc94e46a79e8
--- /dev/null
+++ b/scripts/kconfig/POTFILES.in
@@ -0,0 +1,5 @@
+scripts/kconfig/mconf.c
+scripts/kconfig/conf.c
+scripts/kconfig/confdata.c
+scripts/kconfig/gconf.c
+scripts/kconfig/qconf.cc
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index a494d1aeb9f9..70e7264c6942 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -34,7 +34,7 @@ static int conf_cnt;
 static signed char line[128];
 static struct menu *rootEntry;
 
-static char nohelp_text[] = "Sorry, no help available for this option yet.\n";
+static char nohelp_text[] = N_("Sorry, no help available for this option yet.\n");
 
 static void strip(signed char *str)
 {
@@ -56,9 +56,9 @@ static void strip(signed char *str)
 static void check_stdin(void)
 {
         if (!valid_stdin && input_mode == ask_silent) {
-                printf("aborted!\n\n");
-                printf("Console input/output is redirected. ");
-                printf("Run 'make oldconfig' to update configuration.\n\n");
+                printf(_("aborted!\n\n"));
+                printf(_("Console input/output is redirected. "));
+                printf(_("Run 'make oldconfig' to update configuration.\n\n"));
                 exit(1);
         }
 }
@@ -470,7 +470,7 @@ static void check_conf(struct menu *menu)
         if (sym) {
                 if (sym_is_changable(sym) && !sym_has_value(sym)) {
                         if (!conf_cnt++)
-                                printf("*\n* Restart config...\n*\n");
+                                printf(_("*\n* Restart config...\n*\n"));
                         rootEntry = menu_get_parent_menu(menu);
                         conf(rootEntry);
                 }
@@ -504,7 +504,7 @@ int main(int ac, char **av)
                         input_mode = set_default;
                         defconfig_file = av[i++];
                         if (!defconfig_file) {
-                                printf("%s: No default config file specified\n",
+                                printf(_("%s: No default config file specified\n"),
                                         av[0]);
                                 exit(1);
                         }
@@ -530,7 +530,7 @@ int main(int ac, char **av)
         }
         name = av[i];
         if (!name) {
-                printf("%s: Kconfig file missing\n", av[0]);
+                printf(_("%s: Kconfig file missing\n"), av[0]);
         }
         conf_parse(name);
         //zconfdump(stdout);
@@ -547,12 +547,12 @@ int main(int ac, char **av)
                 break;
         case ask_silent:
                 if (stat(".config", &tmpstat)) {
-                        printf("***\n"
+                        printf(_("***\n"
                                 "*** You have not yet configured your kernel!\n"
                                 "***\n"
                                 "*** Please run some configurator (e.g. \"make oldconfig\" or\n"
                                 "*** \"make menuconfig\" or \"make xconfig\").\n"
-                                "***\n");
+                                "***\n"));
                         exit(1);
                 }
         case ask_all:
@@ -576,7 +576,7 @@ int main(int ac, char **av)
                 check_conf(&rootmenu);
         } while (conf_cnt);
         if (conf_write(NULL)) {
-                fprintf(stderr, "\n*** Error during writing of the kernel configuration.\n\n");
+                fprintf(stderr, _("\n*** Error during writing of the kernel configuration.\n\n"));
                 return 1;
         }
         return 0;
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 1e82ae390a69..2755c459d780 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -88,9 +88,9 @@ int conf_read(const char *name)
                         name = conf_expand_value(name);
                         in = zconf_fopen(name);
                         if (in) {
-                                printf("#\n"
-                                       "# using defaults found in %s\n"
-                                       "#\n", name);
+                                printf(_("#\n"
+                                         "# using defaults found in %s\n"
+                                         "#\n"), name);
                                 break;
                         }
                 }
@@ -312,11 +312,11 @@ int conf_write(const char *name)
         if (env && *env)
                 use_timestamp = 0;
 
-        fprintf(out, "#\n"
-                     "# Automatically generated make config: don't edit\n"
-                     "# Linux kernel version: %s\n"
-                     "%s%s"
-                     "#\n",
+        fprintf(out, _("#\n"
+                       "# Automatically generated make config: don't edit\n"
+                       "# Linux kernel version: %s\n"
+                       "%s%s"
+                       "#\n"),
                      sym_get_string_value(sym),
                      use_timestamp ? "# " : "",
                      use_timestamp ? ctime(&now) : "");
diff --git a/scripts/kconfig/gconf.c b/scripts/kconfig/gconf.c
index 6fdbe6e3ce0d..ad6b12043874 100644
--- a/scripts/kconfig/gconf.c
+++ b/scripts/kconfig/gconf.c
@@ -41,7 +41,7 @@ static gboolean resizeable = FALSE;
 static gboolean config_changed = FALSE;
 
 static char nohelp_text[] =
-    "Sorry, no help available for this option yet.\n";
+    N_("Sorry, no help available for this option yet.\n");
 
 GtkWidget *main_wnd = NULL;
 GtkWidget *tree1_w = NULL;      // left  frame
@@ -193,7 +193,7 @@ void init_main_window(const gchar * glade_file)
 
         xml = glade_xml_new(glade_file, "window1", NULL);
         if (!xml)
-                g_error("GUI loading failed !\n");
+                g_error(_("GUI loading failed !\n"));
         glade_xml_signal_autoconnect(xml);
 
         main_wnd = glade_xml_get_widget(xml, "window1");
@@ -275,7 +275,7 @@ void init_main_window(const gchar * glade_file)
                                           /*"style", PANGO_STYLE_OBLIQUE, */
                                           NULL);
 
-        sprintf(title, "Linux Kernel v%s Configuration",
+        sprintf(title, _("Linux Kernel v%s Configuration"),
                 getenv("KERNELRELEASE"));
         gtk_window_set_title(GTK_WINDOW(main_wnd), title);
 
@@ -325,7 +325,7 @@ void init_left_tree(void)
         
         column = gtk_tree_view_column_new();
         gtk_tree_view_append_column(view, column);
-        gtk_tree_view_column_set_title(column, "Options");
+        gtk_tree_view_column_set_title(column, _("Options"));
 
         renderer = gtk_cell_renderer_toggle_new();
         gtk_tree_view_column_pack_start(GTK_TREE_VIEW_COLUMN(column),
@@ -370,7 +370,7 @@ void init_right_tree(void)
 
         column = gtk_tree_view_column_new();
         gtk_tree_view_append_column(view, column);
-        gtk_tree_view_column_set_title(column, "Options");
+        gtk_tree_view_column_set_title(column, _("Options"));
 
         renderer = gtk_cell_renderer_pixbuf_new();
         gtk_tree_view_column_pack_start(GTK_TREE_VIEW_COLUMN(column),
@@ -401,7 +401,7 @@ void init_right_tree(void)
 
         renderer = gtk_cell_renderer_text_new();
         gtk_tree_view_insert_column_with_attributes(view, -1,
-                                                    "Name", renderer,
+                                                    _("Name"), renderer,
                                                     "text", COL_NAME,
                                                     "foreground-gdk",
                                                     COL_COLOR, NULL);
@@ -425,7 +425,7 @@ void init_right_tree(void)
                                                     COL_COLOR, NULL);
         renderer = gtk_cell_renderer_text_new();
         gtk_tree_view_insert_column_with_attributes(view, -1,
-                                                    "Value", renderer,
+                                                    _("Value"), renderer,
                                                     "text", COL_VALUE,
                                                     "editable",
                                                     COL_EDIT,
@@ -466,15 +466,15 @@ static void text_insert_help(struct menu *menu)
         GtkTextIter start, end;
         const char *prompt = menu_get_prompt(menu);
         gchar *name;
-        const char *help = nohelp_text;
+        const char *help = _(nohelp_text);
 
         if (!menu->sym)
                 help = "";
         else if (menu->sym->help)
-                help = menu->sym->help;
+                help = _(menu->sym->help);
 
         if (menu->sym && menu->sym->name)
-                name = g_strdup_printf(menu->sym->name);
+                name = g_strdup_printf(_(menu->sym->name));
         else
                 name = g_strdup("");
 
@@ -530,7 +530,7 @@ gboolean on_window1_delete_event(GtkWidget * widget, GdkEvent * event,
         if (config_changed == FALSE)
                 return FALSE;
 
-        dialog = gtk_dialog_new_with_buttons("Warning !",
+        dialog = gtk_dialog_new_with_buttons(_("Warning !"),
                                              GTK_WINDOW(main_wnd),
                                              (GtkDialogFlags)
                                              (GTK_DIALOG_MODAL |
@@ -544,7 +544,7 @@ gboolean on_window1_delete_event(GtkWidget * widget, GdkEvent * event,
         gtk_dialog_set_default_response(GTK_DIALOG(dialog),
                                         GTK_RESPONSE_CANCEL);
 
-        label = gtk_label_new("\nSave configuration ?\n");
+        label = gtk_label_new(_("\nSave configuration ?\n"));
         gtk_container_add(GTK_CONTAINER(GTK_DIALOG(dialog)->vbox), label);
         gtk_widget_show(label);
 
@@ -604,7 +604,7 @@ load_filename(GtkFileSelection * file_selector, gpointer user_data)
                                              (user_data));
 
         if (conf_read(fn))
-                text_insert_msg("Error", "Unable to load configuration !");
+                text_insert_msg(_("Error"), _("Unable to load configuration !"));
         else
                 display_tree(&rootmenu);
 }
@@ -613,7 +613,7 @@ void on_load1_activate(GtkMenuItem * menuitem, gpointer user_data)
 {
         GtkWidget *fs;
 
-        fs = gtk_file_selection_new("Load file...");
+        fs = gtk_file_selection_new(_("Load file..."));
         g_signal_connect(GTK_OBJECT(GTK_FILE_SELECTION(fs)->ok_button),
                          "clicked",
                          G_CALLBACK(load_filename), (gpointer) fs);
@@ -632,7 +632,7 @@ void on_load1_activate(GtkMenuItem * menuitem, gpointer user_data)
 void on_save1_activate(GtkMenuItem * menuitem, gpointer user_data)
 {
         if (conf_write(NULL))
-                text_insert_msg("Error", "Unable to save configuration !");
+                text_insert_msg(_("Error"), _("Unable to save configuration !"));
 
         config_changed = FALSE;
 }
@@ -647,7 +647,7 @@ store_filename(GtkFileSelection * file_selector, gpointer user_data)
                                              (user_data));
 
         if (conf_write(fn))
-                text_insert_msg("Error", "Unable to save configuration !");
+                text_insert_msg(_("Error"), _("Unable to save configuration !"));
 
         gtk_widget_destroy(GTK_WIDGET(user_data));
 }
@@ -656,7 +656,7 @@ void on_save_as1_activate(GtkMenuItem * menuitem, gpointer user_data)
 {
         GtkWidget *fs;
 
-        fs = gtk_file_selection_new("Save file as...");
+        fs = gtk_file_selection_new(_("Save file as..."));
         g_signal_connect(GTK_OBJECT(GTK_FILE_SELECTION(fs)->ok_button),
                          "clicked",
                          G_CALLBACK(store_filename), (gpointer) fs);
@@ -740,7 +740,7 @@ on_show_debug_info1_activate(GtkMenuItem * menuitem, gpointer user_data)
 void on_introduction1_activate(GtkMenuItem * menuitem, gpointer user_data)
 {
         GtkWidget *dialog;
-        const gchar *intro_text =
+        const gchar *intro_text = _(
             "Welcome to gkc, the GTK+ graphical kernel configuration tool\n"
             "for Linux.\n"
             "For each option, a blank box indicates the feature is disabled, a\n"
@@ -756,7 +756,7 @@ void on_introduction1_activate(GtkMenuItem * menuitem, gpointer user_data)
             "option.\n"
             "\n"
             "Toggling Show Debug Info under the Options menu will show \n"
-            "the dependencies, which you can then match by examining other options.";
+            "the dependencies, which you can then match by examining other options.");
 
         dialog = gtk_message_dialog_new(GTK_WINDOW(main_wnd),
                                         GTK_DIALOG_DESTROY_WITH_PARENT,
@@ -773,8 +773,8 @@ void on_about1_activate(GtkMenuItem * menuitem, gpointer user_data)
 {
         GtkWidget *dialog;
         const gchar *about_text =
-            "gkc is copyright (c) 2002 Romain Lievin <roms@lpg.ticalc.org>.\n"
-            "Based on the source code from Roman Zippel.\n";
+            _("gkc is copyright (c) 2002 Romain Lievin <roms@lpg.ticalc.org>.\n"
+              "Based on the source code from Roman Zippel.\n");
 
         dialog = gtk_message_dialog_new(GTK_WINDOW(main_wnd),
                                         GTK_DIALOG_DESTROY_WITH_PARENT,
@@ -791,9 +791,9 @@ void on_license1_activate(GtkMenuItem * menuitem, gpointer user_data)
 {
         GtkWidget *dialog;
         const gchar *license_text =
-            "gkc is released under the terms of the GNU GPL v2.\n"
-            "For more information, please see the source code or\n"
-            "visit http://www.fsf.org/licenses/licenses.html\n";
+            _("gkc is released under the terms of the GNU GPL v2.\n"
+              "For more information, please see the source code or\n"
+              "visit http://www.fsf.org/licenses/licenses.html\n");
 
         dialog = gtk_message_dialog_new(GTK_WINDOW(main_wnd),
                                         GTK_DIALOG_DESTROY_WITH_PARENT,
@@ -1579,6 +1579,10 @@ int main(int ac, char *av[])
         kconfig_load();
 #endif
 
+        bindtextdomain(PACKAGE, LOCALEDIR);
+        bind_textdomain_codeset(PACKAGE, "UTF-8");
+        textdomain(PACKAGE);
+
         /* GTK stuffs */
         gtk_set_locale();
         gtk_init(&ac, &av);
diff --git a/scripts/kconfig/kxgettext.c b/scripts/kconfig/kxgettext.c
new file mode 100644
index 000000000000..1c88d7c6d5a7
--- /dev/null
+++ b/scripts/kconfig/kxgettext.c
@@ -0,0 +1,221 @@
+/*
+ * Arnaldo Carvalho de Melo <acme@conectiva.com.br>, 2005
+ *
+ * Released under the terms of the GNU GPL v2.0
+ */
+
+#include <stdlib.h>
+#include <string.h>
+
+#define LKC_DIRECT_LINK
+#include "lkc.h"
+
+static char *escape(const char* text, char *bf, int len)
+{
+        char *bfp = bf;
+        int multiline = strchr(text, '\n') != NULL;
+
+        *bfp++ = '"';
+        --len;
+
+        if (multiline) {
+                *bfp++ = '"';
+                *bfp++ = '\n';
+                *bfp++ = '"';
+                len -= 3;
+        }
+
+        while (*text != '\0' && len > 1) {
+                if (*text == '"')
+                        *bfp++ = '\\';
+                else if (*text == '\n') {
+                        *bfp++ = '\\';
+                        *bfp++ = 'n';
+                        *bfp++ = '"';
+                        *bfp++ = '\n';
+                        *bfp++ = '"';
+                        len -= 5;
+                        ++text;
+                        goto next;
+                }
+                *bfp++ = *text++;
+next:
+                --len;
+        }
+
+        if (multiline)
+                bfp -= 3;
+
+        *bfp++ = '"';
+        *bfp = '\0';
+
+        return bf;
+}
+
+struct file_line {
+        struct file_line *next;
+        char*            file;
+        int              lineno;
+};
+
+static struct file_line *file_line__new(char *file, int lineno)
+{
+        struct file_line *self = malloc(sizeof(*self));
+
+        if (self == NULL)
+                goto out;
+
+        self->file   = file;
+        self->lineno = lineno;
+        self->next   = NULL;
+out:
+        return self;
+}
+
+struct message {
+        const char       *msg;
+        const char       *option;
+        struct message   *next;
+        struct file_line *files;
+};
+
+static struct message *message__list;
+
+static struct message *message__new(const char *msg, char *option, char *file, int lineno)
+{
+        struct message *self = malloc(sizeof(*self));
+
+        if (self == NULL)
+                goto out;
+
+        self->files = file_line__new(file, lineno);
+        if (self->files == NULL)
+                goto out_fail;
+
+        self->msg = strdup(msg);
+        if (self->msg == NULL)
+                goto out_fail_msg;
+
+        self->option = option;
+        self->next = NULL;
+out:
+        return self;
+out_fail_msg:
+        free(self->files);
+out_fail:
+        free(self);
+        self = NULL;
+        goto out;
+}
+
+static struct message *mesage__find(const char *msg)
+{
+        struct message *m = message__list;
+
+        while (m != NULL) {
+                if (strcmp(m->msg, msg) == 0)
+                        break;
+                m = m->next;
+        }
+
+        return m;
+}
+
+static int message__add_file_line(struct message *self, char *file, int lineno)
+{
+        int rc = -1;
+        struct file_line *fl = file_line__new(file, lineno);
+
+        if (fl == NULL)
+                goto out;
+
+        fl->next    = self->files;
+        self->files = fl;
+        rc = 0;
+out:
+        return rc;
+}
+
+static int message__add(const char *msg, char *option, char *file, int lineno)
+{
+        int rc = 0;
+        char bf[16384];
+        char *escaped = escape(msg, bf, sizeof(bf));
+        struct message *m = mesage__find(escaped);
+
+        if (m != NULL)
+                rc = message__add_file_line(m, file, lineno);
+        else {
+                m = message__new(escaped, option, file, lineno);
+
+                if (m != NULL) {
+                        m->next       = message__list;
+                        message__list = m;
+                } else
+                        rc = -1;
+        }
+        return rc;
+}
+
+void menu_build_message_list(struct menu *menu)
+{
+        struct menu *child;
+
+        message__add(menu_get_prompt(menu), NULL,
+                     menu->file == NULL ? "Root Menu" : menu->file->name,
+                     menu->lineno);
+
+        if (menu->sym != NULL && menu->sym->help != NULL)
+                message__add(menu->sym->help, menu->sym->name,
+                             menu->file == NULL ? "Root Menu" : menu->file->name,
+                             menu->lineno);
+
+        for (child = menu->list; child != NULL; child = child->next)
+                if (child->prompt != NULL)
+                        menu_build_message_list(child);
+}
+
+static void message__print_file_lineno(struct message *self)
+{
+        struct file_line *fl = self->files;
+
+        printf("\n#: %s:%d", fl->file, fl->lineno);
+        fl = fl->next;
+
+        while (fl != NULL) {
+                printf(", %s:%d", fl->file, fl->lineno);
+                fl = fl->next;
+        }
+
+        if (self->option != NULL)
+                printf(", %s:00000", self->option);
+
+        putchar('\n');
+}
+
+static void message__print_gettext_msgid_msgstr(struct message *self)
+{
+        message__print_file_lineno(self);
+
+        printf("msgid %s\n"
+               "msgstr \"\"\n", self->msg);
+}
+
+void menu__xgettext(void)
+{
+        struct message *m = message__list;
+
+        while (m != NULL) {
+                message__print_gettext_msgid_msgstr(m);
+                m = m->next;
+        }
+}
+
+int main(int ac, char **av)
+{
+        conf_parse(av[1]);
+
+        menu_build_message_list(menu_get_root_menu(NULL));
+        menu__xgettext();
+        return 0;
+}
diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
index b8a67fc9d647..8b84c42b49b5 100644
--- a/scripts/kconfig/lkc.h
+++ b/scripts/kconfig/lkc.h
@@ -8,6 +8,8 @@
 
 #include "expr.h"
 
+#include <libintl.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -23,6 +25,12 @@ extern "C" {
 
 #define SRCTREE "srctree"
 
+#define PACKAGE "linux"
+#define LOCALEDIR "/usr/share/locale"
+
+#define _(text) gettext(text)
+#define N_(text) (text)
+
 int zconfparse(void);
 void zconfdump(FILE *out);
 
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 730d316fe7fe..e5db10ca9564 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -4,6 +4,8 @@
  *
  * Introduced single menu mode (show all sub-menus in one large tree).
  * 2002-11-06 Petr Baudis <pasky@ucw.cz>
+ *
+ * i18n, 2005, Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  */
 
 #include <sys/ioctl.h>
@@ -23,7 +25,7 @@
 #include "lkc.h"
 
 static char menu_backtitle[128];
-static const char mconf_readme[] =
+static const char mconf_readme[] = N_(
 "Overview\n"
 "--------\n"
 "Some kernel features may be built directly into the kernel.\n"
@@ -156,39 +158,39 @@ static const char mconf_readme[] =
 "\n"
 "Note that this mode can eventually be a little more CPU expensive\n"
 "(especially with a larger number of unrolled categories) than the\n"
-"default mode.\n",
-menu_instructions[] =
+"default mode.\n"),
+menu_instructions[] = N_(
         "Arrow keys navigate the menu.  "
         "<Enter> selects submenus --->.  "
         "Highlighted letters are hotkeys.  "
         "Pressing <Y> includes, <N> excludes, <M> modularizes features.  "
         "Press <Esc><Esc> to exit, <?> for Help, </> for Search.  "
-        "Legend: [*] built-in  [ ] excluded  <M> module  < > module capable",
-radiolist_instructions[] =
+        "Legend: [*] built-in  [ ] excluded  <M> module  < > module capable"),
+radiolist_instructions[] = N_(
         "Use the arrow keys to navigate this window or "
         "press the hotkey of the item you wish to select "
         "followed by the <SPACE BAR>. "
-        "Press <?> for additional information about this option.",
-inputbox_instructions_int[] =
+        "Press <?> for additional information about this option."),
+inputbox_instructions_int[] = N_(
         "Please enter a decimal value. "
         "Fractions will not be accepted.  "
-        "Use the <TAB> key to move from the input field to the buttons below it.",
-inputbox_instructions_hex[] =
+        "Use the <TAB> key to move from the input field to the buttons below it."),
+inputbox_instructions_hex[] = N_(
         "Please enter a hexadecimal value. "
-        "Use the <TAB> key to move from the input field to the buttons below it.",
-inputbox_instructions_string[] =
+        "Use the <TAB> key to move from the input field to the buttons below it."),
+inputbox_instructions_string[] = N_(
         "Please enter a string value. "
-        "Use the <TAB> key to move from the input field to the buttons below it.",
-setmod_text[] =
+        "Use the <TAB> key to move from the input field to the buttons below it."),
+setmod_text[] = N_(
         "This feature depends on another which has been configured as a module.\n"
-        "As a result, this feature will be built as a module.",
-nohelp_text[] =
-        "There is no help available for this kernel option.\n",
-load_config_text[] =
+        "As a result, this feature will be built as a module."),
+nohelp_text[] = N_(
+        "There is no help available for this kernel option.\n"),
+load_config_text[] = N_(
         "Enter the name of the configuration file you wish to load.  "
         "Accept the name shown to restore the configuration you "
-        "last retrieved.  Leave blank to abort.",
-load_config_help[] =
+        "last retrieved.  Leave blank to abort."),
+load_config_help[] = N_(
         "\n"
         "For various reasons, one may wish to keep several different kernel\n"
         "configurations available on a single machine.\n"
@@ -198,11 +200,11 @@ load_config_help[] =
         "to modify that configuration.\n"
         "\n"
         "If you are uncertain, then you have probably never used alternate\n"
-        "configuration files.  You should therefor leave this blank to abort.\n",
-save_config_text[] =
+        "configuration files.  You should therefor leave this blank to abort.\n"),
+save_config_text[] = N_(
         "Enter a filename to which this configuration should be saved "
-        "as an alternate.  Leave blank to abort.",
-save_config_help[] =
+        "as an alternate.  Leave blank to abort."),
+save_config_help[] = N_(
         "\n"
         "For various reasons, one may wish to keep different kernel\n"
         "configurations available on a single machine.\n"
@@ -212,8 +214,8 @@ save_config_help[] =
         "configuration options you have selected at that time.\n"
         "\n"
         "If you are uncertain what all this means then you should probably\n"
-        "leave this blank.\n",
-search_help[] =
+        "leave this blank.\n"),
+search_help[] = N_(
         "\n"
         "Search for CONFIG_ symbols and display their relations.\n"
         "Example: search for \"^FOO\"\n"
@@ -250,7 +252,7 @@ search_help[] =
         "Examples: USB  => find all CONFIG_ symbols containing USB\n"
         "          ^USB => find all CONFIG_ symbols starting with USB\n"
         "          USB$ => find all CONFIG_ symbols ending with USB\n"
-        "\n";
+        "\n");
 
 static signed char buf[4096], *bufptr = buf;
 static signed char input_buf[4096];
@@ -305,8 +307,8 @@ static void init_wsize(void)
         }
 
         if (rows < 19 || cols < 80) {
-                fprintf(stderr, "Your display is too small to run Menuconfig!\n");
-                fprintf(stderr, "It must be at least 19 lines by 80 columns.\n");
+                fprintf(stderr, N_("Your display is too small to run Menuconfig!\n"));
+                fprintf(stderr, N_("It must be at least 19 lines by 80 columns.\n"));
                 exit(1);
         }
 
@@ -526,9 +528,9 @@ static void search_conf(void)
 again:
         cprint_init();
         cprint("--title");
-        cprint("Search Configuration Parameter");
+        cprint(_("Search Configuration Parameter"));
         cprint("--inputbox");
-        cprint("Enter Keyword");
+        cprint(_("Enter Keyword"));
         cprint("10");
         cprint("75");
         cprint("");
@@ -539,7 +541,7 @@ again:
         case 0:
                 break;
         case 1:
-                show_helptext("Search Configuration", search_help);
+                show_helptext(_("Search Configuration"), search_help);
                 goto again;
         default:
                 return;
@@ -548,7 +550,7 @@ again:
         sym_arr = sym_re_search(input_buf);
         res = get_relations_str(sym_arr);
         free(sym_arr);
-        show_textbox("Search Results", str_get(&res), 0, 0);
+        show_textbox(_("Search Results"), str_get(&res), 0, 0);
         str_free(&res);
 }
 
@@ -721,9 +723,9 @@ static void conf(struct menu *menu)
         while (1) {
                 cprint_init();
                 cprint("--title");
-                cprint("%s", prompt ? prompt : "Main Menu");
+                cprint("%s", prompt ? prompt : _("Main Menu"));
                 cprint("--menu");
-                cprint(menu_instructions);
+                cprint(_(menu_instructions));
                 cprint("%d", rows);
                 cprint("%d", cols);
                 cprint("%d", rows - 10);
@@ -736,9 +738,9 @@ static void conf(struct menu *menu)
                         cprint(":");
                         cprint("--- ");
                         cprint("L");
-                        cprint("    Load an Alternate Configuration File");
+                        cprint(_("    Load an Alternate Configuration File"));
                         cprint("S");
-                        cprint("    Save Configuration to an Alternate File");
+                        cprint(_("    Save Configuration to an Alternate File"));
                 }
                 stat = exec_conf();
                 if (stat < 0)
@@ -793,7 +795,7 @@ static void conf(struct menu *menu)
                         if (sym)
                                 show_help(submenu);
                         else
-                                show_helptext("README", mconf_readme);
+                                show_helptext("README", _(mconf_readme));
                         break;
                 case 3:
                         if (type == 't') {
@@ -849,7 +851,7 @@ static void show_help(struct menu *menu)
         {
                 if (sym->name) {
                         str_printf(&help, "CONFIG_%s:\n\n", sym->name);
-                        str_append(&help, sym->help);
+                        str_append(&help, _(sym->help));
                         str_append(&help, "\n");
                 }
         } else {
@@ -886,9 +888,9 @@ static void conf_choice(struct menu *menu)
         while (1) {
                 cprint_init();
                 cprint("--title");
-                cprint("%s", prompt ? prompt : "Main Menu");
+                cprint("%s", prompt ? prompt : _("Main Menu"));
                 cprint("--radiolist");
-                cprint(radiolist_instructions);
+                cprint(_(radiolist_instructions));
                 cprint("15");
                 cprint("70");
                 cprint("6");
@@ -935,17 +937,17 @@ static void conf_string(struct menu *menu)
         while (1) {
                 cprint_init();
                 cprint("--title");
-                cprint("%s", prompt ? prompt : "Main Menu");
+                cprint("%s", prompt ? prompt : _("Main Menu"));
                 cprint("--inputbox");
                 switch (sym_get_type(menu->sym)) {
                 case S_INT:
-                        cprint(inputbox_instructions_int);
+                        cprint(_(inputbox_instructions_int));
                         break;
                 case S_HEX:
-                        cprint(inputbox_instructions_hex);
+                        cprint(_(inputbox_instructions_hex));
                         break;
                 case S_STRING:
-                        cprint(inputbox_instructions_string);
+                        cprint(_(inputbox_instructions_string));
                         break;
                 default:
                         /* panic? */;
@@ -958,7 +960,7 @@ static void conf_string(struct menu *menu)
                 case 0:
                         if (sym_set_string_value(menu->sym, input_buf))
                                 return;
-                        show_textbox(NULL, "You have made an invalid entry.", 5, 43);
+                        show_textbox(NULL, _("You have made an invalid entry."), 5, 43);
                         break;
                 case 1:
                         show_help(menu);
@@ -987,10 +989,10 @@ static void conf_load(void)
                                 return;
                         if (!conf_read(input_buf))
                                 return;
-                        show_textbox(NULL, "File does not exist!", 5, 38);
+                        show_textbox(NULL, _("File does not exist!"), 5, 38);
                         break;
                 case 1:
-                        show_helptext("Load Alternate Configuration", load_config_help);
+                        show_helptext(_("Load Alternate Configuration"), load_config_help);
                         break;
                 case 255:
                         return;
@@ -1016,10 +1018,10 @@ static void conf_save(void)
                                 return;
                         if (!conf_write(input_buf))
                                 return;
-                        show_textbox(NULL, "Can't create file!  Probably a nonexistent directory.", 5, 60);
+                        show_textbox(NULL, _("Can't create file!  Probably a nonexistent directory."), 5, 60);
                         break;
                 case 1:
-                        show_helptext("Save Alternate Configuration", save_config_help);
+                        show_helptext(_("Save Alternate Configuration"), save_config_help);
                         break;
                 case 255:
                         return;
@@ -1040,12 +1042,16 @@ int main(int ac, char **av)
         char *mode;
         int stat;
 
+        setlocale(LC_ALL, "");
+        bindtextdomain(PACKAGE, LOCALEDIR);
+        textdomain(PACKAGE);
+
         conf_parse(av[1]);
         conf_read(NULL);
 
         sym = sym_lookup("KERNELRELEASE", 0);
         sym_calc_value(sym);
-        sprintf(menu_backtitle, "Linux Kernel v%s Configuration",
+        sprintf(menu_backtitle, _("Linux Kernel v%s Configuration"),
                 sym_get_string_value(sym));
 
         mode = getenv("MENUCONFIG_MODE");
@@ -1062,7 +1068,7 @@ int main(int ac, char **av)
         do {
                 cprint_init();
                 cprint("--yesno");
-                cprint("Do you wish to save your new kernel configuration?");
+                cprint(_("Do you wish to save your new kernel configuration?"));
                 cprint("5");
                 cprint("60");
                 stat = exec_conf();
@@ -1070,20 +1076,20 @@ int main(int ac, char **av)
 
         if (stat == 0) {
                 if (conf_write(NULL)) {
-                        fprintf(stderr, "\n\n"
+                        fprintf(stderr, _("\n\n"
                                 "Error during writing of the kernel configuration.\n"
                                 "Your kernel configuration changes were NOT saved."
-                                "\n\n");
+                                "\n\n"));
                         return 1;
                 }
-                printf("\n\n"
+                printf(_("\n\n"
                         "*** End of Linux kernel configuration.\n"
                         "*** Execute 'make' to build the kernel or try 'make help'."
-                        "\n\n");
+                        "\n\n"));
         } else {
-                fprintf(stderr, "\n\n"
+                fprintf(stderr, _("\n\n"
                         "Your kernel configuration changes were NOT saved."
-                        "\n\n");
+                        "\n\n"));
         }
 
         return 0;
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 0c13156f3344..8c59b212722d 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -365,9 +365,9 @@ bool menu_is_visible(struct menu *menu)
 const char *menu_get_prompt(struct menu *menu)
 {
         if (menu->prompt)
-                return menu->prompt->text;
+                return _(menu->prompt->text);
         else if (menu->sym)
-                return menu->sym->name;
+                return _(menu->sym->name);
         return NULL;
 }
 
diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index 0cdbf9dbbd51..4590cd31623f 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -26,8 +26,23 @@
 #include "qconf.moc"
 #include "images.c"
 
+#ifdef _
+# undef _
+# define _ qgettext
+#endif
+
 static QApplication *configApp;
 
+static inline QString qgettext(const char* str)
+{
+  return QString::fromLocal8Bit(gettext(str));
+}
+
+static inline QString qgettext(const QString& str)
+{
+  return QString::fromLocal8Bit(gettext(str.latin1()));
+}
+
 ConfigSettings::ConfigSettings()
         : showAll(false), showName(false), showRange(false), showData(false)
 {
@@ -177,7 +192,7 @@ void ConfigItem::updateMenu(void)
 
         sym = menu->sym;
         prop = menu->prompt;
-        prompt = menu_get_prompt(menu);
+        prompt = QString::fromLocal8Bit(menu_get_prompt(menu));
 
         if (prop) switch (prop->type) {
         case P_MENU:
@@ -203,7 +218,7 @@ void ConfigItem::updateMenu(void)
         if (!sym)
                 goto set_prompt;
 
-        setText(nameColIdx, sym->name);
+        setText(nameColIdx, QString::fromLocal8Bit(sym->name));
 
         type = sym_get_type(sym);
         switch (type) {
@@ -213,9 +228,9 @@ void ConfigItem::updateMenu(void)
 
                 if (!sym_is_changable(sym) && !list->showAll) {
                         setPixmap(promptColIdx, 0);
-                        setText(noColIdx, 0);
-                        setText(modColIdx, 0);
-                        setText(yesColIdx, 0);
+                        setText(noColIdx, QString::null);
+                        setText(modColIdx, QString::null);
+                        setText(yesColIdx, QString::null);
                         break;
                 }
                 expr = sym_get_tristate_value(sym);
@@ -257,6 +272,7 @@ void ConfigItem::updateMenu(void)
                 const char* data;
 
                 data = sym_get_string_value(sym);
+
 #if QT_VERSION >= 300
                 int i = list->mapIdx(dataColIdx);
                 if (i >= 0)
@@ -264,9 +280,9 @@ void ConfigItem::updateMenu(void)
 #endif
                 setText(dataColIdx, data);
                 if (type == S_STRING)
-                        prompt.sprintf("%s: %s", prompt.latin1(), data);
+                        prompt = QString("%1: %2").arg(prompt).arg(data);
                 else
-                        prompt.sprintf("(%s) %s", data, prompt.latin1());
+                        prompt = QString("(%2) %1").arg(prompt).arg(data);
                 break;
         }
         if (!sym_has_value(sym) && visible)
@@ -343,9 +359,9 @@ void ConfigLineEdit::show(ConfigItem* i)
 {
         item = i;
         if (sym_get_string_value(item->menu->sym))
-                setText(sym_get_string_value(item->menu->sym));
+                setText(QString::fromLocal8Bit(sym_get_string_value(item->menu->sym)));
         else
-                setText(0);
+                setText(QString::null);
         Parent::show();
         setFocus();
 }
@@ -961,7 +977,7 @@ ConfigMainWindow::ConfigMainWindow(void)
         delete configSettings;
 }
 
-static QString print_filter(const char *str)
+static QString print_filter(const QString &str)
 {
         QRegExp re("[<>&\"\\n]");
         QString res = str;
@@ -994,7 +1010,7 @@ static QString print_filter(const char *str)
 
 static void expr_print_help(void *data, const char *str)
 {
-        ((QString*)data)->append(print_filter(str));
+        reinterpret_cast<QString*>(data)->append(print_filter(str));
 }
 
 /*
@@ -1009,7 +1025,7 @@ void ConfigMainWindow::setHelp(QListViewItem* item)
         if (item)
                 menu = ((ConfigItem*)item)->menu;
         if (!menu) {
-                helpText->setText(NULL);
+                helpText->setText(QString::null);
                 return;
         }
 
@@ -1019,16 +1035,16 @@ void ConfigMainWindow::setHelp(QListViewItem* item)
         if (sym) {
                 if (menu->prompt) {
                         head += "<big><b>";
-                        head += print_filter(menu->prompt->text);
+                        head += print_filter(_(menu->prompt->text));
                         head += "</b></big>";
                         if (sym->name) {
                                 head += " (";
-                                head += print_filter(sym->name);
+                                head += print_filter(_(sym->name));
                                 head += ")";
                         }
                 } else if (sym->name) {
                         head += "<big><b>";
-                        head += print_filter(sym->name);
+                        head += print_filter(_(sym->name));
                         head += "</b></big>";
                 }
                 head += "<br><br>";
@@ -1049,7 +1065,7 @@ void ConfigMainWindow::setHelp(QListViewItem* item)
                                 case P_PROMPT:
                                 case P_MENU:
                                         debug += "prompt: ";
-                                        debug += print_filter(prop->text);
+                                        debug += print_filter(_(prop->text));
                                         debug += "<br>";
                                         break;
                                 case P_DEFAULT:
@@ -1088,10 +1104,10 @@ void ConfigMainWindow::setHelp(QListViewItem* item)
                         debug += "<br>";
                 }
 
-                help = print_filter(sym->help);
+                help = print_filter(_(sym->help));
         } else if (menu->prompt) {
                 head += "<big><b>";
-                head += print_filter(menu->prompt->text);
+                head += print_filter(_(menu->prompt->text));
                 head += "</b></big><br><br>";
                 if (showDebug) {
                         if (menu->prompt->visible.expr) {
@@ -1111,7 +1127,7 @@ void ConfigMainWindow::loadConfig(void)
         QString s = QFileDialog::getOpenFileName(".config", NULL, this);
         if (s.isNull())
                 return;
-        if (conf_read(s.latin1()))
+        if (conf_read(QFile::encodeName(s)))
                 QMessageBox::information(this, "qconf", "Unable to load configuration!");
         ConfigView::updateListAll();
 }
@@ -1127,7 +1143,7 @@ void ConfigMainWindow::saveConfigAs(void)
         QString s = QFileDialog::getSaveFileName(".config", NULL, this);
         if (s.isNull())
                 return;
-        if (conf_write(s.latin1()))
+        if (conf_write(QFile::encodeName(s)))
                 QMessageBox::information(this, "qconf", "Unable to save configuration!");
 }
 
@@ -1372,6 +1388,9 @@ int main(int ac, char** av)
         ConfigMainWindow* v;
         const char *name;
 
+        bindtextdomain(PACKAGE, LOCALEDIR);
+        textdomain(PACKAGE);
+
 #ifndef LKC_DIRECT_LINK
         kconfig_load();
 #endif
diff --git a/scripts/patch-kernel b/scripts/patch-kernel
index 43af01075612..f2d47ca9c8fa 100755
--- a/scripts/patch-kernel
+++ b/scripts/patch-kernel
@@ -46,6 +46,19 @@
 # fix some whitespace damage;
 # be smarter about stopping when current version is larger than requested;
 #       Randy Dunlap <rddunlap@osdl.org>, 2004-AUG-18.
+#
+# Add better support for (non-incremental) 2.6.x.y patches;
+# If an ending version number if not specified, the script automatically
+# increments the SUBLEVEL (x in 2.6.x.y) until no more patch files are found;
+# however, EXTRAVERSION (y in 2.6.x.y) is never automatically incremented
+# but must be specified fully.
+#
+# patch-kernel does not normally support reverse patching, but does so when
+# applying EXTRAVERSION (x.y) patches, so that moving from 2.6.11.y to 2.6.11.z
+# is easy and handled by the script (reverse 2.6.11.y and apply 2.6.11.z).
+#       Randy Dunlap <rddunlap@osdl.org>, 2005-APR-08.
+
+PNAME=patch-kernel
 
 # Set directories from arguments, or use defaults.
 sourcedir=${1-/usr/src/linux}
@@ -54,7 +67,7 @@ stopvers=${3-default}
 
 if [ "$1" == -h -o "$1" == --help -o ! -r "$sourcedir/Makefile" ]; then
 cat << USAGE
-usage: patch-kernel [-h] [ sourcedir [ patchdir [ stopversion ] [ -acxx ] ] ]
+usage: $PNAME [-h] [ sourcedir [ patchdir [ stopversion ] [ -acxx ] ] ]
   source directory defaults to /usr/src/linux,
   patch directory defaults to the current directory,
   stopversion defaults to <all in patchdir>.
@@ -73,6 +86,19 @@ do
 done
 
 # ---------------------------------------------------------------------------
+# arg1 is filename
+noFile () {
+        echo "cannot find patch file: ${patch}"
+        exit 1
+}
+
+# ---------------------------------------------------------------------------
+backwards () {
+        echo "$PNAME does not support reverse patching"
+        exit 1
+}
+
+# ---------------------------------------------------------------------------
 # Find a file, first parameter is basename of file
 # it tries many compression mechanisms and sets variables to say how to get it
 findFile () {
@@ -133,6 +159,28 @@ applyPatch () {
   return 0;
 }
 
+# ---------------------------------------------------------------------------
+# arg1 is patch filename
+reversePatch () {
+        echo -n "Reversing $1 (${name}) ... "
+        if $uncomp ${patchdir}/"$1"${ext} | patch -p1 -Rs -N -E -d $sourcedir
+        then
+                echo "done."
+        else
+                echo "failed.  Clean it up."
+                exit 1
+        fi
+        if [ "`find $sourcedir/ '(' -name '*.rej' -o -name '.*.rej' ')' -print`" ]
+        then
+                echo "Aborting.  Reject files found."
+                return 1
+        fi
+        # Remove backup files
+        find $sourcedir/ '(' -name '*.orig' -o -name '.*.orig' ')' -exec rm -f {} \;
+
+        return 0
+}
+
 # set current VERSION, PATCHLEVEL, SUBLEVEL, EXTRAVERSION
 TMPFILE=`mktemp .tmpver.XXXXXX` || { echo "cannot make temp file" ; exit 1; }
 grep -E "^(VERSION|PATCHLEVEL|SUBLEVEL|EXTRAVERSION)" $sourcedir/Makefile > $TMPFILE
@@ -160,53 +208,57 @@ then
                 EXTRAVER=$EXTRAVERSION
         fi
         EXTRAVER=${EXTRAVER%%[[:punct:]]*}
-        #echo "patch-kernel: changing EXTRAVERSION from $EXTRAVERSION to $EXTRAVER"
+        #echo "$PNAME: changing EXTRAVERSION from $EXTRAVERSION to $EXTRAVER"
 fi
 
 #echo "stopvers=$stopvers"
 if [ $stopvers != "default" ]; then
         STOPSUBLEVEL=`echo $stopvers | cut -d. -f3`
         STOPEXTRA=`echo $stopvers | cut -d. -f4`
-        #echo "STOPSUBLEVEL=$STOPSUBLEVEL, STOPEXTRA=$STOPEXTRA"
+        #echo "#___STOPSUBLEVEL=/$STOPSUBLEVEL/, STOPEXTRA=/$STOPEXTRA/"
 else
         STOPSUBLEVEL=9999
         STOPEXTRA=9999
 fi
 
-while :                         # incrementing SUBLEVEL (s in v.p.s)
-do
-    if [ x$EXTRAVER != "x" ]; then
+# This all assumes a 2.6.x[.y] kernel tree.
+# Don't allow backwards/reverse patching.
+if [ $STOPSUBLEVEL -lt $SUBLEVEL ]; then
+        backwards
+fi
+
+if [ x$EXTRAVER != "x" ]; then
         CURRENTFULLVERSION="$VERSION.$PATCHLEVEL.$SUBLEVEL.$EXTRAVER"
-    else
+else
         CURRENTFULLVERSION="$VERSION.$PATCHLEVEL.$SUBLEVEL"
-    fi
+fi
+
+if [ x$EXTRAVER != "x" ]; then
+        echo "backing up to: $VERSION.$PATCHLEVEL.$SUBLEVEL"
+        patch="patch-${CURRENTFULLVERSION}"
+        findFile $patchdir/${patch} || noFile ${patch}
+        reversePatch ${patch} || exit 1
+fi
 
+# now current is 2.6.x, with no EXTRA applied,
+# so update to target SUBLEVEL (2.6.SUBLEVEL)
+# and then to target EXTRAVER (2.6.SUB.EXTRAVER) if requested.
+# If not ending sublevel is specified, it is incremented until
+# no further sublevels are found.
+
+if [ $STOPSUBLEVEL -gt $SUBLEVEL ]; then
+while :                         # incrementing SUBLEVEL (s in v.p.s)
+do
+    CURRENTFULLVERSION="$VERSION.$PATCHLEVEL.$SUBLEVEL"
+    EXTRAVER=
     if [ $stopvers == $CURRENTFULLVERSION ]; then
         echo "Stopping at $CURRENTFULLVERSION base as requested."
         break
     fi
 
-    while :                     # incrementing EXTRAVER (x in v.p.s.x)
-    do
-        EXTRAVER=$((EXTRAVER + 1))
-        FULLVERSION="$VERSION.$PATCHLEVEL.$SUBLEVEL.$EXTRAVER"
-        #echo "... trying $FULLVERSION ..."
-
-        patch=patch-$FULLVERSION
-
-        # See if the file exists and find extension
-        findFile $patchdir/${patch} || break
-
-        # Apply the patch and check all is OK
-        applyPatch $patch || break
-
-        continue 2
-    done
-
-    EXTRAVER=
     SUBLEVEL=$((SUBLEVEL + 1))
     FULLVERSION="$VERSION.$PATCHLEVEL.$SUBLEVEL"
-    #echo "___ trying $FULLVERSION ___"
+    #echo "#___ trying $FULLVERSION ___"
 
     if [ $((SUBLEVEL)) -gt $((STOPSUBLEVEL)) ]; then
         echo "Stopping since sublevel ($SUBLEVEL) is beyond stop-sublevel ($STOPSUBLEVEL)"
@@ -214,14 +266,33 @@ do
     fi
 
     patch=patch-$FULLVERSION
-
     # See if the file exists and find extension
-    findFile $patchdir/${patch} || break
+    findFile $patchdir/${patch} || noFile ${patch}
 
     # Apply the patch and check all is OK
     applyPatch $patch || break
 done
-#echo "base all done"
+#echo "#___sublevel all done"
+fi
+
+# There is no incremental searching for extraversion...
+if [ "$STOPEXTRA" != "" ]; then
+while :                         # just to allow break
+do
+# apply STOPEXTRA directly (not incrementally) (x in v.p.s.x)
+        FULLVERSION="$VERSION.$PATCHLEVEL.$SUBLEVEL.$STOPEXTRA"
+        #echo "#... trying $FULLVERSION ..."
+        patch=patch-$FULLVERSION
+
+        # See if the file exists and find extension
+        findFile $patchdir/${patch} || noFile ${patch}
+
+        # Apply the patch and check all is OK
+        applyPatch $patch || break
+        #echo "#___extraver all done"
+        break
+done
+fi
 
 if [ x$gotac != x ]; then
   # Out great user wants the -ac patches
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 5a820cf88c9c..8449d667b062 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -476,8 +476,8 @@ int security_compute_av(u32 ssid,
         int rc = 0;
 
         if (!ss_initialized) {
-                avd->allowed = requested;
-                avd->decided = requested;
+                avd->allowed = 0xffffffff;
+                avd->decided = 0xffffffff;
                 avd->auditallow = 0;
                 avd->auditdeny = 0xffffffff;
                 avd->seqno = latest_granting;
@@ -1196,9 +1196,11 @@ int security_load_policy(void *data, size_t len)
                 }
                 policydb_loaded_version = policydb.policyvers;
                 ss_initialized = 1;
-
+                seqno = ++latest_granting;
                 LOAD_UNLOCK;
                 selinux_complete_init();
+                avc_ss_reset(seqno);
+                selnl_notify_policyload(seqno);
                 return 0;
         }
 
diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
index 4a6be966bd9f..3a3228b18726 100644
--- a/sound/isa/Kconfig
+++ b/sound/isa/Kconfig
@@ -164,6 +164,7 @@ config SND_INTERWAVE
         select SND_RAWMIDI
         select SND_CS4231_LIB
         select SND_GUS_SYNTH
+        select ISAPNP
         help
           Say Y here to include support for AMD InterWave based
           soundcards (Gravis UltraSound Plug & Play, STB SoundRage32,
diff --git a/sound/oss/ac97_codec.c b/sound/oss/ac97_codec.c
index 124b1e10a13d..3ecef4689f1b 100644
--- a/sound/oss/ac97_codec.c
+++ b/sound/oss/ac97_codec.c
@@ -155,6 +155,7 @@ static const struct {
         {0x43525931, "Cirrus Logic CS4299 rev A", &crystal_digital_ops},
         {0x43525933, "Cirrus Logic CS4299 rev C", &crystal_digital_ops},
         {0x43525934, "Cirrus Logic CS4299 rev D", &crystal_digital_ops},
+        {0x43585430, "CXT48",                   &default_ops,           AC97_DELUDED_MODEM },
         {0x43585442, "CXT66",                   &default_ops,           AC97_DELUDED_MODEM },
         {0x44543031, "Diamond Technology DT0893", &default_ops},
         {0x45838308, "ESS Allegro ES1988",      &null_ops},
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index d143d2c78988..8b33b12fa5dc 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -125,8 +125,8 @@ MODULE_PARM_DESC(xbox, "Set to 1 for Xbox, if you have problems with the AC'97 c
 #ifndef PCI_DEVICE_ID_INTEL_ICH7_20
 #define PCI_DEVICE_ID_INTEL_ICH7_20     0x27de
 #endif
-#ifndef PCI_DEVICE_ID_INTEL_ESB2_13
-#define PCI_DEVICE_ID_INTEL_ESB2_13     0x2698
+#ifndef PCI_DEVICE_ID_INTEL_ESB2_14
+#define PCI_DEVICE_ID_INTEL_ESB2_14     0x2698
 #endif
 #ifndef PCI_DEVICE_ID_SI_7012
 #define PCI_DEVICE_ID_SI_7012           0x7012
@@ -2741,7 +2741,7 @@ static struct shortname_table {
         { PCI_DEVICE_ID_INTEL_ESB_5, "Intel 6300ESB" },
         { PCI_DEVICE_ID_INTEL_ICH6_18, "Intel ICH6" },
         { PCI_DEVICE_ID_INTEL_ICH7_20, "Intel ICH7" },
-        { PCI_DEVICE_ID_INTEL_ESB2_13, "Intel ESB2" },
+        { PCI_DEVICE_ID_INTEL_ESB2_14, "Intel ESB2" },
         { PCI_DEVICE_ID_SI_7012, "SiS SI7012" },
         { PCI_DEVICE_ID_NVIDIA_MCP_AUDIO, "NVidia nForce" },
         { PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO, "NVidia nForce2" },
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index f1ce808501da..9b4d74d49f98 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -1836,7 +1836,7 @@ static void __devinit snd_via82xx_proc_init(via82xx_t *chip)
  *
  */
 
-static int __devinit snd_via82xx_chip_init(via82xx_t *chip)
+static int snd_via82xx_chip_init(via82xx_t *chip)
 {
         unsigned int val;
         int max_count;